Coverage / crates/hub/src/keyless.rs 88.2%

pub fn audience(base_url: &str) -> String {

    format!("{}/keyless", base_url.trim_end_matches('/'))

}

pub async fn author_chain(app: &Shared, account_id: i64, grantor: oxy_core::hash::KeyId) -> Vec<Identity> {

    let linked = db::accounts::identities_of(&app.db, account_id).await.unwrap_or_default();

    let ids: std::collections::HashMap<oxy_core::hash::KeyId, Identity> =

        linked.iter().filter_map(|l| Identity::decode(&l.object).ok()).map(|i| (i.hash(), i)).collect();

    let mut best: Vec<Identity> = Vec::new();

    for head in ids.values() {

        let mut chain = vec![head.clone()];

        let mut cur = head;

        let reached = loop {

            match cur.previous {

                Some(p) if p == grantor => break true,

                None => break false,

        if reached && best.first().is_none_or(|b| head.created > b.created) {

            best = chain;

        }

    best

}

fn bad(status: StatusCode, why: impl Into<String>) -> ApiError {

    ApiError(status, why.into())

}

async fn job_proof(app: &Shared, token: &str) -> Result<Proven, ApiError> {

    let invalid = || bad(StatusCode::UNAUTHORIZED, "this job token is not valid (the job must be running)");

    let hash = crate::auth::token_hash(token);

    let job = db::flow::job_by_token(&app.db, &hash, crate::flow::JOB_TOKEN_MAX_AGE_MS)

        .await

        .map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(invalid)?;

    let run = db::flow::run_by_id(&app.db, job.run_id)

        .await

        .map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(invalid)?;

    let repo = db::repos::get_by_id(&app.db, run.repo_id)

        .await

        .map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(invalid)?;

    let mut claims = vec![

        ("repository".to_string(), format!("{}/{}", repo.owner, repo.name)),

        ("bookmark".to_string(), run.bookmark.clone()),

        ("run".to_string(), run.number.to_string()),

        ("job".to_string(), job.name.clone()),

        ("runner".to_string(), job.runner.clone()),

    if !job.environment.is_empty() && !job.approved_by.is_empty() {

    }

    Ok(Proven {

        subject: format!("repo:{}/{}:bookmark:{}", repo.owner, repo.name, run.bookmark),

        claims,

        until_ms: job.started_ms.unwrap_or(0) + crate::flow::JOB_TOKEN_MAX_AGE_MS,

        target: format!("{}/{}", repo.owner, repo.name),

        allowed: Scope::CHANGES | Scope::REFS | Scope::SEAL,

        grant: None,

    })

}

async fn oidc_proof(app: &Shared, token: &str, now: i64) -> Result<Proven, ApiError> {

    let issuer = app.oidc().await.map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let aud = audience(app.config.base_url());

    let claims = issuer

        .verify(token, &aud, now)

        .ok_or_else(|| bad(StatusCode::UNAUTHORIZED, format!("the token is not one of this hub's, for audience {aud}, still valid")))?;

    let subject = claims["sub"].as_str().unwrap_or("").to_string();

    if subject.is_empty() {

    }

    let keep = ["repository", "bookmark", "run_number", "job", "runner", "environment", "approved_by"];

    let mut out = Vec::new();

    for k in keep {

        match &claims[k] {

            _ => {}

    Ok(Proven {

        target: claims["repository"].as_str().unwrap_or(&subject).to_string(),

        subject,

        claims: out,

        until_ms: claims["exp"].as_i64().unwrap_or(0) * 1000,

        allowed: Scope::CHANGES | Scope::REFS | Scope::SEAL,

        grant: None,

    })

}

async fn grant_proof(app: &Shared, token: &str, now: i64) -> Result<Proven, ApiError> {

    let invalid = || bad(StatusCode::UNAUTHORIZED, "this agent grant is not valid (revoked, ended or unknown)");

    let g = db::accounts::agent_grant_by_token(&app.db, &crate::auth::token_hash(token))

        .await

        .map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .filter(|g| g.live(now))

        .ok_or_else(invalid)?;

    let signed = SignedGrant::decode(&g.signed).map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    db::accounts::touch_agent_grant(&app.db, g.id).await.ok();

    Ok(Proven {

        subject: g.subject.clone(),

        claims: vec![("agent".to_string(), g.agent.clone()), ("grant".to_string(), g.id.to_string())],

        until_ms: g.expires_ms,

        target: g.subject,

        allowed: signed.grant.scope,

        grant: Some(signed),

    })

}

pub async fn certify(

    State(app): State<Shared>,

    headers: HeaderMap,

    Json(req): Json<CertifyRequest>,

) -> Result<Json<CertifyResponse>, ApiError> {

    let token = oxy_server::bearer_token(&headers)

        .ok_or_else(|| bad(StatusCode::UNAUTHORIZED, "ask with a job token or one of this hub's OIDC tokens as the bearer"))?

        .to_string();

    let now = db::now_ms();

    let proven = if token.starts_with(crate::flow::JOB_TOKEN_PREFIX) {

        job_proof(&app, &token).await?

    } else if token.starts_with(GRANT_TOKEN_PREFIX) {

        grant_proof(&app, &token, now).await?

        oidc_proof(&app, &token, now).await?

    let decode = |what: &str, b64: &str| {

        oxy_core::dsse::base64_decode(b64.trim()).ok_or_else(|| bad(StatusCode::BAD_REQUEST, format!("{what} is not base64")))

    };

    let identity =

        Identity::decode(&decode("identity", &req.identity)?).map_err(|e| bad(StatusCode::BAD_REQUEST, format!("identity: {e}")))?;

    let proof = oxy_core::cbor::decode(&decode("proof", &req.proof)?)

        .map_err(|e| e.to_string())

        .and_then(|v| Signature::from_value(&v).map_err(|e| e.to_string()))

        .map_err(|e| bad(StatusCode::BAD_REQUEST, format!("proof: {e}")))?;

    verify_challenge(&identity, &proof, &certify_challenge(&token))

        .map_err(|e| bad(StatusCode::UNAUTHORIZED, format!("the proof does not show this key's holder asked: {e}")))?;

    let asked = Scope::parse(&req.scope).map_err(|e| bad(StatusCode::BAD_REQUEST, e))?;

    let scope =

        asked.names().into_iter().filter_map(|n| Scope::parse(n).ok()).filter(|s| proven.allowed.has(*s)).fold(Scope::NONE, |a, s| a | s);

    if scope.is_empty() {

    }

    let expires = (now + LIFETIME_MS).min(proven.until_ms);

    if expires <= now {

    }

    let (key, secret) =

        crate::keys::load_secret(&app.config.keys_dir()).map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let cert = Certificate {

        key: identity,

        issuer: key,

        subject: proven.subject.clone(),

        claims: proven.claims,

        scope,

        not_before: (now - SKEW_MS) as u64,

        expires: expires as u64,

        grant: proven.grant,

    };

    let grantor = match &cert.grant {

        Some(g) => db::accounts::identity_by_key(&app.db, &g.grant.grantor.to_hex()).await.ok().flatten(),

        None => None,

    let grantor_account = grantor.as_ref().map(|l| l.account_id);

    let grantor_identity = grantor.map(|l| oxy_core::dsse::base64(&l.object));

    let author_chain = match (&cert.grant, &grantor_account) {

        (Some(g), Some(account)) => {

            author_chain(&app, *account, g.grant.grantor).await.iter().map(|i| oxy_core::dsse::base64(&i.encode())).collect()

        _ => Vec::new(),

    let signed = SignedCertificate::sign(cert, &app.hub_key.identity, &secret);

    let detail = format!("{} for {} until {}", signed.cert.key_id().short(12), proven.subject, expires);

    db::accounts::audit(&app.db, None, "keyless.certified", &proven.target, &detail).await.ok();

    crate::tlog::log(

        &app,

        vec![crate::tlog::Pending {

            kind: "certificate",

            repo: [0; 16],

            repo_row: None,

            object: signed.cert.hash(),

            signers: vec![app.hub_key.key],

        }],

    )

    .await;

    Ok(Json(CertifyResponse {

        certificate: oxy_core::dsse::base64(&signed.encode()),

        subject: proven.subject,

        expires_ms: expires,

        grantor_identity,

        author_chain,

    }))

}

    fn from(g: db::accounts::AgentGrant) -> Self {

        GrantView {

            id: g.id,

            agent: g.agent,

            subject: g.subject,

            grantor: g.grantor,

            scope: g.scope,

            created_ms: g.created_ms,

            expires_ms: g.expires_ms,

            revoked_ms: g.revoked_ms,

            last_used_ms: g.last_used_ms,

            token: None,

        }

    }

async fn owner(app: &Shared, headers: &HeaderMap) -> Result<db::accounts::Account, ApiError> {

    let c = crate::api::caller(app, headers).await?;

    if c.agent {

        return Err(bad(StatusCode::FORBIDDEN, "an agent's token cannot manage agent grants: use your own"));

    }

    c.account.ok_or_else(|| bad(StatusCode::UNAUTHORIZED, "a personal access token is required"))

}

fn agent_name_ok(name: &str) -> bool {

    !name.is_empty() && name.len() <= 64 && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')

}

pub async fn grants_create(

    State(app): State<Shared>,

    headers: HeaderMap,

    Json(req): Json<GrantRequest>,

) -> Result<(StatusCode, Json<GrantView>), ApiError> {

    let account = owner(&app, &headers).await?;

    let bytes = oxy_core::dsse::base64_decode(req.grant.trim()).ok_or_else(|| bad(StatusCode::BAD_REQUEST, "the grant is not base64"))?;

    let signed = SignedGrant::decode(&bytes).map_err(|e| bad(StatusCode::BAD_REQUEST, format!("grant: {e}")))?;

    let g = &signed.grant;

    let suffix = format!("@{}", account.username);

    let agent = g

        .subject

        .strip_prefix("agent:")

        .and_then(|r| r.strip_suffix(&suffix))

        .filter(|n| agent_name_ok(n))

        .ok_or_else(|| bad(StatusCode::BAD_REQUEST, format!("a grant here is for agent:NAME{suffix}, not {}", g.subject)))?

        .to_string();

    if g.issuer != app.hub_key.key {

    }

    let grantor = g.grantor.to_hex();

    let linked = db::accounts::identity_by_key(&app.db, &grantor)

        .await

        .map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .filter(|i| i.account_id == account.id)

        .ok_or_else(|| bad(StatusCode::FORBIDDEN, format!("key {} is not linked to your account: link it first", g.grantor.short(12))))?;

    let identity = Identity::decode(&linked.object).map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    signed.verify(&identity).map_err(|e| bad(StatusCode::BAD_REQUEST, format!("the grant does not verify: {e}")))?;

    let now = db::now_ms();

    if (g.expires as i64) <= now {

    }

    let token = format!("{GRANT_TOKEN_PREFIX}{}", crate::auth::random_hex(32));

    let hash = crate::auth::token_hash(&token);

    let scope = g.scope.to_string();

    let id = db::accounts::create_agent_grant(

        &app.db,

        db::accounts::NewAgentGrant {

            account_id: account.id,

            agent: &agent,

            subject: &g.subject,

            grantor: &grantor,

            scope: &scope,

            signed: &bytes,

            token_hash: &hash,

            expires_ms: g.expires as i64,

        },

    )

    .await

    .map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    db::accounts::audit(&app.db, Some(&account), "agent.granted", &g.subject, &format!("grant {id}, {scope}, until {}", g.expires))

        .await

        .ok();

    Ok((

        StatusCode::CREATED,

        Json(GrantView {

            id,

            agent,

            subject: g.subject.clone(),

            grantor,

            scope,

            created_ms: now,

            expires_ms: g.expires as i64,

            revoked_ms: None,

            last_used_ms: None,

            token: Some(token),

        }),

    ))

}

pub async fn grants_list(State(app): State<Shared>, headers: HeaderMap) -> Result<Json<Vec<GrantView>>, ApiError> {

    let account = owner(&app, &headers).await?;

    let grants =

        db::accounts::agent_grants_of(&app.db, account.id).await.map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    Ok(Json(grants.into_iter().map(GrantView::from).collect()))

}

pub async fn grants_revoke(State(app): State<Shared>, headers: HeaderMap, Path(id): Path<i64>) -> Result<StatusCode, ApiError> {

    let account = owner(&app, &headers).await?;

    let done = db::accounts::revoke_agent_grant(&app.db, account.id, id)

        .await

        .map_err(|e| bad(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    if !done {

    }

    db::accounts::audit(&app.db, Some(&account), "agent.revoked", &format!("grant {id}"), "").await.ok();

    Ok(StatusCode::NO_CONTENT)

}