artifacts.rs 87.0%

107 of 123 lines run, 13 of 48 functions · run #470 on main · run missed

//! A repository's Artifacts menu (oxygenhub#254): every run's build
//! artifacts in one list, the runner images its jobs use, and its
//! Terraform state. Releases and reports keep their own pages.

use super::settings::{csrf, require};
use super::{filters, lookup, lookup_role, Error, Page, RepoShell, Shell};
use crate::auth::{Access, Viewer};
use crate::db::flow as fdb;
use crate::{db, Shared};
use askama::Template;
use axum::extract::{Form, Path, Query, State};
use axum::http::header;
use axum::response::{IntoResponse, Response};
use serde::Deserialize;

/// At most this many artifacts are listed, newest first.
const ARTIFACTS_SHOWN: i64 = 200;
/// Images used within this many days are listed.
const IMAGE_DAYS: i64 = 90;

#[derive(Template)]
#[template(path = "repo_artifacts.html")]
pub struct ArtifactsPage {
    shell: Shell,
    repo: RepoShell,
    artifacts: Vec<fdb::RepoArtifact>,
    limit: i64,
}

/// `GET /{owner}/{name}/artifacts`.
pub async fn artifacts(
    State(app): State<Shared>,
    viewer: Viewer,
    Path((owner, name)): Path<(String, String)>,
) -> Result<Page<ArtifactsPage>, Error> {
    let shell = Shell::new(&app, &format!("/{owner}/{name}/artifacts"), &viewer);
    let (_repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;
    let artifacts = fdb::repo_artifacts(&app.db, row.id, ARTIFACTS_SHOWN).await.map_err(|e| Error::from_db(shell.clone(), e))?;
    Ok(Page(ArtifactsPage { shell, repo: RepoShell::new(&app, &row, "artifacts").with_role(role), artifacts, limit: ARTIFACTS_SHOWN }))
}

/// One image this repository's jobs ran on.
pub struct ImageView {
    /// The image's BLAKE3, or what the pipeline named when it is not a hash.
    pub image: String,
    pub hashed: bool,
    pub jobs: i64,
    pub last_ms: i64,
    /// Kept by the hub: its size and architecture.
    pub kept: Option<(i64, String)>,
}

#[derive(Template)]
#[template(path = "repo_images.html")]
pub struct ImagesPage {
    shell: Shell,
    repo: RepoShell,
    images: Vec<ImageView>,
    days: i64,
}

/// `GET /{owner}/{name}/images`.
pub async fn images(
    State(app): State<Shared>,
    viewer: Viewer,
    Path((owner, name)): Path<(String, String)>,
) -> Result<Page<ImagesPage>, Error> {
    let shell = Shell::new(&app, &format!("/{owner}/{name}/images"), &viewer);
    let (_repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;
    let e = |e| Error::from_db(shell.clone(), e);
    let uses = crate::images::uses_of(&app.db, row.id, db::now_ms() - IMAGE_DAYS * 24 * 3600 * 1000).await.map_err(e)?;
    let kept = crate::images::kept(&app.db).await.map_err(e)?;
    let images = uses
        .into_iter()
        .map(|u| {
            let kept = kept.iter().find(|k| k.hash.eq_ignore_ascii_case(&u.image)).map(|k| (k.size, k.arch.clone()));
            ImageView { hashed: jet::images::is_hash(&u.image), image: u.image, jobs: u.jobs, last_ms: u.last_ms, kept }
        })
        .collect();
    Ok(Page(ImagesPage { shell, repo: RepoShell::new(&app, &row, "images").with_role(role), images, days: IMAGE_DAYS }))
}

/// A state with its kept versions, newest first.
pub struct StateView {
    pub s: db::terraform::TfState,
    pub versions: Vec<db::terraform::TfVersion>,
}

#[derive(Template)]
#[template(path = "repo_terraform.html")]
pub struct TerraformPage {
    shell: Shell,
    repo: RepoShell,
    states: Vec<StateView>,
    notice: Option<String>,
    error: Option<String>,
}

async fn terraform_page(
    app: &Shared,
    shell: Shell,
    row: db::repos::RepoRow,
    role: crate::auth::Role,
    notice: Option<String>,
    error: Option<String>,
) -> Result<Page<TerraformPage>, Error> {
    let e = |e| Error::from_db(shell.clone(), e);
    let mut states = Vec::new();
    // States hold secrets (#256): only writers see them listed.
    if crate::auth::roles::allows(Some(role), Access::Write) {
        for s in db::terraform::of_repo(&app.db, row.id).await.map_err(e)? {
            let versions = db::terraform::version_list(&app.db, row.id, &s.name).await.map_err(e)?;
            states.push(StateView { s, versions });
        }
    }
    Ok(Page(TerraformPage { shell, repo: RepoShell::new(app, &row, "terraform").with_role(role), states, notice, error }))
}

/// `GET /{owner}/{name}/terraform`: the states the hub keeps for this
/// repository (oxygenhub#252), their versions, and the backend block.
pub async fn terraform(
    State(app): State<Shared>,
    viewer: Viewer,
    Path((owner, name)): Path<(String, String)>,
) -> Result<Page<TerraformPage>, Error> {
    let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);
    let (_repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;
    terraform_page(&app, shell, row, role, None, None).await
}

#[derive(Deserialize)]
pub struct DownloadQuery {
    version: Option<i64>,
}

/// `GET /{owner}/{name}/terraform/{state}/download[?version=ID]`: the
/// current state, or a kept version, for people with the write role.
pub async fn download(
    State(app): State<Shared>,
    viewer: Viewer,
    Path((owner, name, state)): Path<(String, String, String)>,
    Query(q): Query<DownloadQuery>,
) -> Result<Response, Error> {
    let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);
    let (_repo, row, _role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Write).await?;
    let e = |e| Error::from_db(shell.clone(), e);
    let (body, serial) = match q.version {
        Some(id) => db::terraform::version_body(&app.db, row.id, &state, id).await.map_err(e)?,
        None => db::terraform::get(&app.db, row.id, &state).await.map_err(e)?.filter(|s| !s.body.is_empty()).map(|s| (s.body, s.serial)),
    }
    .ok_or_else(|| Error::not_found(shell.clone()))?;
    let plain = app.secret_key.open(&body).ok_or_else(|| Error::not_found(shell.clone()))?;
    let file = format!("{}-serial-{serial}.tfstate", state.replace(|c: char| !(c.is_ascii_alphanumeric() || "-_.".contains(c)), "_"));
    Ok((
        [
            (header::CONTENT_TYPE, "application/json".to_string()),
            (header::CONTENT_DISPOSITION, format!("attachment; filename=\"{file}\"")),
            (header::CACHE_CONTROL, "no-store".to_string()),
        ],
        plain,
    )
        .into_response())
}

#[derive(Deserialize)]
pub struct RestoreForm {
    #[serde(rename = "_csrf")]
    csrf_token: String,
    version: i64,
}

/// `POST /{owner}/{name}/terraform/{state}/restore` (#255): restore a kept
/// version, by someone with the maintain role, audited.
pub async fn restore(
    State(app): State<Shared>,
    viewer: Viewer,
    Path((owner, name, state)): Path<(String, String, String)>,
    Form(f): Form<RestoreForm>,
) -> Result<Page<TerraformPage>, Error> {
    let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);
    let me = require(&viewer, &shell)?;
    let (_repo, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Maintain).await?;
    csrf(&viewer, &f.csrf_token, &shell)?;
    match crate::terraform::restore(&app, row.id, &state, f.version, &me.account.username).await {
        Ok(serial) => {
            db::accounts::audit(
                &app.db,
                Some(&me.account),
                "terraform.restored",
                &format!("{owner}/{name}:{state}"),
                &format!("version {}, now serial {serial}", f.version),
            )
            .await
            .ok();
            let msg = format!(
                "Restored {state}: it is now serial {serial}. The state it replaced is kept as a version, so you can go back to it."
            );
            terraform_page(&app, shell, row, role, Some(msg), None).await
        }
        Err(e) => terraform_page(&app, shell, row, role, None, Some(format!("Could not restore {state}: {}.", e.message()))).await,
    }
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! A repository's Artifacts menu (oxygenhub#254): every run's build
2		//! artifacts in one list, the runner images its jobs use, and its
3		//! Terraform state. Releases and reports keep their own pages.
4
5		use super::settings::{csrf, require};
6		use super::{filters, lookup, lookup_role, Error, Page, RepoShell, Shell};
7		use crate::auth::{Access, Viewer};
8		use crate::db::flow as fdb;
9		use crate::{db, Shared};
10		use askama::Template;
11		use axum::extract::{Form, Path, Query, State};
12		use axum::http::header;
13		use axum::response::{IntoResponse, Response};
14		use serde::Deserialize;
15
16		/// At most this many artifacts are listed, newest first.
17		const ARTIFACTS_SHOWN: i64 = 200;
18		/// Images used within this many days are listed.
19		const IMAGE_DAYS: i64 = 90;
20
21		#[derive(Template)]
22		#[template(path = "repo_artifacts.html")]
23		pub struct ArtifactsPage {
24		shell: Shell,
25		repo: RepoShell,
26		artifacts: Vec<fdb::RepoArtifact>,
27		limit: i64,
28		}
29
30		/// `GET /{owner}/{name}/artifacts`.
31	2×	pub async fn artifacts(
32	2×	State(app): State<Shared>,
33	2×	viewer: Viewer,
34	2×	Path((owner, name)): Path<(String, String)>,
35	2×	) -> Result<Page<ArtifactsPage>, Error> {
36	2×	let shell = Shell::new(&app, &format!("/{owner}/{name}/artifacts"), &viewer);
37	2×	let (_repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;
38	2×	let artifacts = fdb::repo_artifacts(&app.db, row.id, ARTIFACTS_SHOWN).await.map_err(\|e\| Error::from_db(shell.clone(), e))?;
39	2×	Ok(Page(ArtifactsPage { shell, repo: RepoShell::new(&app, &row, "artifacts").with_role(role), artifacts, limit: ARTIFACTS_SHOWN }))
40	2×	}
41
42		/// One image this repository's jobs ran on.
43		pub struct ImageView {
44		/// The image's BLAKE3, or what the pipeline named when it is not a hash.
45		pub image: String,
46		pub hashed: bool,
47		pub jobs: i64,
48		pub last_ms: i64,
49		/// Kept by the hub: its size and architecture.
50		pub kept: Option<(i64, String)>,
51		}
52
53		#[derive(Template)]
54		#[template(path = "repo_images.html")]
55		pub struct ImagesPage {
56		shell: Shell,
57		repo: RepoShell,
58		images: Vec<ImageView>,
59		days: i64,
60		}
61
62		/// `GET /{owner}/{name}/images`.
63	1×	pub async fn images(
64	1×	State(app): State<Shared>,
65	1×	viewer: Viewer,
66	1×	Path((owner, name)): Path<(String, String)>,
67	1×	) -> Result<Page<ImagesPage>, Error> {
68	1×	let shell = Shell::new(&app, &format!("/{owner}/{name}/images"), &viewer);
69	1×	let (_repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;
70	1×	let e = \|e\| Error::from_db(shell.clone(), e);
71	1×	let uses = crate::images::uses_of(&app.db, row.id, db::now_ms() - IMAGE_DAYS * 24 * 3600 * 1000).await.map_err(e)?;
72	1×	let kept = crate::images::kept(&app.db).await.map_err(e)?;
73	1×	let images = uses
74	1×	.into_iter()
75	1×	.map(\|u\| {
76	0×	let kept = kept.iter().find(\|k\| k.hash.eq_ignore_ascii_case(&u.image)).map(\|k\| (k.size, k.arch.clone()));
77	0×	ImageView { hashed: jet::images::is_hash(&u.image), image: u.image, jobs: u.jobs, last_ms: u.last_ms, kept }
78	0×	})
79	1×	.collect();
80	1×	Ok(Page(ImagesPage { shell, repo: RepoShell::new(&app, &row, "images").with_role(role), images, days: IMAGE_DAYS }))
81	1×	}
82
83		/// A state with its kept versions, newest first.
84		pub struct StateView {
85		pub s: db::terraform::TfState,
86		pub versions: Vec<db::terraform::TfVersion>,
87		}
88
89		#[derive(Template)]
90		#[template(path = "repo_terraform.html")]
91		pub struct TerraformPage {
92		shell: Shell,
93		repo: RepoShell,
94		states: Vec<StateView>,
95		notice: Option<String>,
96		error: Option<String>,
97		}
98
99	5×	async fn terraform_page(
100	5×	app: &Shared,
101	5×	shell: Shell,
102	5×	row: db::repos::RepoRow,
103	5×	role: crate::auth::Role,
104	5×	notice: Option<String>,
105	5×	error: Option<String>,
106	5×	) -> Result<Page<TerraformPage>, Error> {
107	5×	let e = \|e\| Error::from_db(shell.clone(), e);
108	5×	let mut states = Vec::new();
109		// States hold secrets (#256): only writers see them listed.
110	5×	if crate::auth::roles::allows(Some(role), Access::Write) {
111	3×	for s in db::terraform::of_repo(&app.db, row.id).await.map_err(e)? {
112	3×	let versions = db::terraform::version_list(&app.db, row.id, &s.name).await.map_err(e)?;
113	3×	states.push(StateView { s, versions });
114		}
115	2×	}
116	5×	Ok(Page(TerraformPage { shell, repo: RepoShell::new(app, &row, "terraform").with_role(role), states, notice, error }))
117	5×	}
118
119		/// `GET /{owner}/{name}/terraform`: the states the hub keeps for this
120		/// repository (oxygenhub#252), their versions, and the backend block.
121	4×	pub async fn terraform(
122	4×	State(app): State<Shared>,
123	4×	viewer: Viewer,
124	4×	Path((owner, name)): Path<(String, String)>,
125	4×	) -> Result<Page<TerraformPage>, Error> {
126	4×	let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);
127	4×	let (_repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;
128	4×	terraform_page(&app, shell, row, role, None, None).await
129	4×	}
130
131		#[derive(Deserialize)]
132		pub struct DownloadQuery {
133		version: Option<i64>,
134		}
135
136		/// `GET /{owner}/{name}/terraform/{state}/download[?version=ID]`: the
137		/// current state, or a kept version, for people with the write role.
138	1×	pub async fn download(
139	1×	State(app): State<Shared>,
140	1×	viewer: Viewer,
141	1×	Path((owner, name, state)): Path<(String, String, String)>,
142	1×	Query(q): Query<DownloadQuery>,
143	1×	) -> Result<Response, Error> {
144	1×	let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);
145	1×	let (_repo, row, _role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Write).await?;
146	1×	let e = \|e\| Error::from_db(shell.clone(), e);
147	1×	let (body, serial) = match q.version {
148	1×	Some(id) => db::terraform::version_body(&app.db, row.id, &state, id).await.map_err(e)?,
149	0×	None => db::terraform::get(&app.db, row.id, &state).await.map_err(e)?.filter(\|s\| !s.body.is_empty()).map(\|s\| (s.body, s.serial)),
150		}
151	1×	.ok_or_else(\|\| Error::not_found(shell.clone()))?;
152	1×	let plain = app.secret_key.open(&body).ok_or_else(\|\| Error::not_found(shell.clone()))?;
153	4×	let file = format!("{}-serial-{serial}.tfstate", state.replace(\|c: char\| !(c.is_ascii_alphanumeric() \|\| "-_.".contains(c)), "_"));
154	1×	Ok((
155	1×	[
156	1×	(header::CONTENT_TYPE, "application/json".to_string()),
157	1×	(header::CONTENT_DISPOSITION, format!("attachment; filename=\"{file}\"")),
158	1×	(header::CACHE_CONTROL, "no-store".to_string()),
159	1×	],
160	1×	plain,
161	1×	)
162	1×	.into_response())
163	1×	}
164
165		#[derive(Deserialize)]
166		pub struct RestoreForm {
167		#[serde(rename = "_csrf")]
168		csrf_token: String,
169		version: i64,
170		}
171
172		/// `POST /{owner}/{name}/terraform/{state}/restore` (#255): restore a kept
173		/// version, by someone with the maintain role, audited.
174	1×	pub async fn restore(
175	1×	State(app): State<Shared>,
176	1×	viewer: Viewer,
177	1×	Path((owner, name, state)): Path<(String, String, String)>,
178	1×	Form(f): Form<RestoreForm>,
179	1×	) -> Result<Page<TerraformPage>, Error> {
180	1×	let shell = Shell::new(&app, &format!("/{owner}/{name}/terraform"), &viewer);
181	1×	let me = require(&viewer, &shell)?;
182	1×	let (_repo, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Maintain).await?;
183	1×	csrf(&viewer, &f.csrf_token, &shell)?;
184	1×	match crate::terraform::restore(&app, row.id, &state, f.version, &me.account.username).await {
185	1×	Ok(serial) => {
186	1×	db::accounts::audit(
187	1×	&app.db,
188	1×	Some(&me.account),
189	1×	"terraform.restored",
190	1×	&format!("{owner}/{name}:{state}"),
191	1×	&format!("version {}, now serial {serial}", f.version),
192	1×	)
193	1×	.await
194	1×	.ok();
195	1×	let msg = format!(
196		"Restored {state}: it is now serial {serial}. The state it replaced is kept as a version, so you can go back to it."
197		);
198	1×	terraform_page(&app, shell, row, role, Some(msg), None).await
199		}
200	0×	Err(e) => terraform_page(&app, shell, row, role, None, Some(format!("Could not restore {state}: {}.", e.message()))).await,
201		}
202	1×	}

Coverage / crates/hub/src/web/artifacts.rs 87.0%

Keyboard