drops.rs 81.6%

257 of 315 lines run, 43 of 106 functions · run #496 on main · run missed

//! Drops (oxygenhub#279): small snippets of one or more files, as gists
//! are, each its own Oxygen repository.
//!
//! A drop is a repository named `drops/ID` under its owner, with
//! `repositories.kind = 'drop'`: stored, locked, cloned and pushed as any
//! repository is (`oxy clone https://HUB/OWNER/drops/ID`), but never
//! listed among repositories. Its id is 24 random hex digits, so a secret
//! drop's address cannot be guessed; a secret drop is `private` to every
//! list and readable by anyone who has the address (`auth::roles`). The
//! hub makes its changes as the owner's delegate, as web edits are made,
//! after the same push protection scan a push gets.

use crate::db::{self, accounts::Account, repos::RepoRow};
use crate::repos::edits::{self, Signer};
use crate::repos::{RepoError, RepoName};
use crate::Shared;
use hub_api::Visibility;
use oxy_core::objects::NodeKind;
use oxy_core::repo::FileEdit;
use oxy_core::state::FileContent;

/// Most files a drop takes from the web or the API in one go.
pub const MAX_FILES: usize = 50;
/// Largest file the web or the API takes, in bytes.
pub const MAX_FILE_BYTES: usize = 1 << 20;
/// Longest title and description.
pub const MAX_TITLE: usize = 200;
pub const MAX_DESCRIPTION: usize = 2000;
/// Most text a drop page shows of one file; past it, the raw link.
const SHOWN_BYTES: u64 = 512 * 1024;

/// Why a drop was not made or changed.
#[derive(Debug)]
pub enum DropError {
    /// What the person can fix, said to them.
    Bad(String),
    Repo(RepoError),
    Db(sqlx::Error),
}

impl std::fmt::Display for DropError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            DropError::Bad(m) => f.write_str(m),
            DropError::Repo(e) => write!(f, "{e}"),
            DropError::Db(e) => write!(f, "{e}"),
        }
    }
}

impl From<sqlx::Error> for DropError {
    fn from(e: sqlx::Error) -> DropError {
        DropError::Db(e)
    }
}

impl From<RepoError> for DropError {
    fn from(e: RepoError) -> DropError {
        DropError::Repo(e)
    }
}

fn bad(msg: impl Into<String>) -> DropError {
    DropError::Bad(msg.into())
}

/// `public` or `secret`, as people and the API say it.
pub fn visibility_label(row: &RepoRow) -> &'static str {
    if row.visibility() == Visibility::Public {
        "public"
    } else {
        "secret"
    }
}

fn visibility(secret: bool) -> Visibility {
    if secret {
        Visibility::Private
    } else {
        Visibility::Public
    }
}

/// The drop's id, from its row.
pub fn id_of(row: &RepoRow) -> &str {
    row.name.split_once('/').map(|(_, id)| id).unwrap_or(&row.name)
}

/// `/{owner}/drops/{id}`.
pub fn url_of(row: &RepoRow) -> String {
    format!("/{}/{}", row.owner, row.name)
}

/// The title a page shows: its own, else its first file's name, else its id.
pub fn shown_title(row: &RepoRow, files: &[DropFile]) -> String {
    if !row.title.is_empty() {
        row.title.clone()
    } else if let Some(f) = files.first() {
        f.path.clone()
    } else {
        id_of(row).to_string()
    }
}

/// One of a drop's files.
#[derive(Clone, Debug)]
pub struct DropFile {
    pub path: String,
    pub size: u64,
    /// The text, when the file is text and not too large to show.
    pub text: Option<String>,
}

/// A file as given from the web or the API: a name and its content.
#[derive(Clone, Debug)]
pub struct NewFile {
    pub name: String,
    pub content: String,
}

/// A file name: a path of plain parts, at most 255 bytes.
pub fn check_name(name: &str) -> Result<String, String> {
    let name = name.trim().trim_matches('/');
    if name.is_empty() {
        return Err("Every file needs a name.".into());
    }
    if name.len() > 255 {
        return Err(format!("{name:.40}…: a file name is at most 255 bytes."));
    }
    if name.chars().any(|c| c.is_control() || c == '\\')
        || name.split('/').any(|p| p.is_empty() || p == "." || p == ".." || p == oxy_core::repo::OXY_DIR || p.trim() != p)
    {
        return Err(format!("{name:?} is not a file name: use letters, digits and punctuation, with / between folders."));
    }
    Ok(name.to_string())
}

/// Files from the web or the API, checked: named, not too many or too
/// large, no name twice, and nothing push protection refuses.
pub fn check_files(files: &[NewFile], allow_empty: bool) -> Result<Vec<NewFile>, String> {
    if files.is_empty() && !allow_empty {
        return Err("A drop needs at least one file.".into());
    }
    if files.len() > MAX_FILES {
        return Err(format!("A drop takes at most {MAX_FILES} files at a time."));
    }
    let mut out: Vec<NewFile> = Vec::with_capacity(files.len());
    for f in files {
        let name = check_name(&f.name)?;
        if f.content.len() > MAX_FILE_BYTES {
            return Err(format!("{name} is larger than {} KiB; push larger files with oxy.", MAX_FILE_BYTES / 1024));
        }
        if out.iter().any(|o| o.name == name) {
            return Err(format!("{name} is named twice."));
        }
        // Line endings as the browser's editor shows them.
        out.push(NewFile { name, content: f.content.replace("\r\n", "\n") });
    }
    scan(&out)?;
    Ok(out)
}

/// Push protection (#268) over what the hub is asked to commit: the same
/// rules a push gets, so a drop made on the web cannot carry what a push
/// would be refused for.
pub fn scan(files: &[NewFile]) -> Result<(), String> {
    let rules = crate::push_protection::rules();
    let mut found = Vec::new();
    for f in files {
        for h in crate::push_protection::scan_text(rules, f.content.as_bytes()) {
            let rule = &rules.rules[h.rule];
            found.push(format!("{}:{}: {} (fingerprint {})", f.name, h.line, rule.description, h.fingerprint));
        }
    }
    if found.is_empty() {
        return Ok(());
    }
    Err(format!(
        "Push protection refused this: {} like {}, and nothing was saved. {} Take {} out (read credentials from the environment or a secret store), and if {} real, revoke or rotate {}.",
        if found.len() == 1 { "a value looks".to_string() } else { format!("{} values look", found.len()) },
        if found.len() == 1 { "a secret" } else { "secrets" },
        found.join("; "),
        if found.len() == 1 { "it" } else { "them" },
        if found.len() == 1 { "it is" } else { "one is" },
        if found.len() == 1 { "it" } else { "it as well" },
    ))
}

fn check_text(title: &str, description: &str) -> Result<(), String> {
    if title.chars().count() > MAX_TITLE {
        return Err(format!("A title is at most {MAX_TITLE} characters."));
    }
    if description.chars().count() > MAX_DESCRIPTION {
        return Err(format!("A description is at most {MAX_DESCRIPTION} characters."));
    }
    Ok(())
}

/// The owner's signer: their identity that delegates to the hub's key.
async fn signer(app: &Shared, account: &Account) -> Result<Signer, DropError> {
    crate::web::edit::signer_for(app, account.id).await.map_err(DropError::Bad)
}

/// Make a drop for `account`: a new repository with the files as its first
/// change on `main`, authored by the account's identity and signed by the
/// hub as its delegate. Nothing is left behind when that fails.
pub async fn create(
    app: &Shared,
    account: &Account,
    title: &str,
    description: &str,
    secret: bool,
    files: &[NewFile],
) -> Result<RepoRow, DropError> {
    if account.blocked() {
        return Err(bad("This account cannot make drops."));
    }
    let (title, description) = (title.trim(), description.trim());
    check_text(title, description).map_err(DropError::Bad)?;
    let files = check_files(files, false).map_err(DropError::Bad)?;
    let signer = signer(app, account).await?;
    // Ids are unique across the hub, so `oh drop view ID` needs no owner.
    let mut found = None;
    for _ in 0..8 {
        let id = crate::auth::random_hex(12);
        let Some(name) = RepoName::drop(&account.username, &id) else { break };
        if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
            found = Some(name);
            break;
        }
    }
    let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
    let mut repo_id = [0u8; 16];
    rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut repo_id);
    app.repos.create_async(&name, Some(repo_id)).await?;
    let id = name.drop_id().unwrap_or_default().to_string();
    let row = match db::repos::create_drop(&app.db, &account.username, &id, title, description, visibility(secret)).await {
        Ok(row) => row,
        Err(e) => {
            let _ = std::fs::remove_dir_all(app.repos.dir(&name));
            return Err(e.into());
        }
    };
    let edits: Vec<FileEdit> =
        files.iter().map(|f| FileEdit { path: f.name.clone(), content: Some(f.content.clone().into_bytes()) }).collect();
    let message = if title.is_empty() { "Create the drop".to_string() } else { format!("Create {title}") };
    let b = row.default_bookmark.clone();
    match edits::commit(&app.repos, &name, b.clone(), b, edits, message, signer).await {
        Ok(done) => {
            recorded(app, account, &row, &done, "drop.created", visibility_label(&row)).await;
            Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
        }
        Err(e) => {
            db::repos::delete(&app.db, row.id).await.ok();
            let _ = std::fs::remove_dir_all(app.repos.dir(&name));
            Err(DropError::Bad(format!("The drop was not made: {e}")))
        }
    }
}

/// Fork `source` for `account` (#280): a new drop of theirs whose history
/// starts from it (its objects linked, its bookmarks copied), with its
/// title, description and secrecy, noting where it came from.
pub async fn fork(app: &Shared, account: &Account, source: &RepoRow) -> Result<RepoRow, DropError> {
    if account.blocked() {
        return Err(bad("This account cannot make drops."));
    }
    let Some(from) = RepoName::new(&source.owner, &source.name) else { return Err(bad("That is not a drop.")) };
    let mut found = None;
    for _ in 0..8 {
        let id = crate::auth::random_hex(12);
        let Some(name) = RepoName::drop(&account.username, &id) else { break };
        if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
            found = Some(name);
            break;
        }
    }
    let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
    app.repos.fork(&from, &name).await?;
    let id = name.drop_id().unwrap_or_default().to_string();
    let row = match db::repos::create_drop(&app.db, &account.username, &id, &source.title, &source.description, source.visibility()).await {
        Ok(row) => row,
        Err(e) => {
            let _ = std::fs::remove_dir_all(app.repos.dir(&name));
            return Err(e.into());
        }
    };
    db::repos::set_forked_from(&app.db, row.id, source.id).await?;
    db::accounts::audit(&app.db, Some(account), "drop.forked", &url_of(&row), &url_of(source)).await.ok();
    Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
}

/// What a change to a drop's text or files is.
pub struct Update {
    pub title: String,
    pub description: String,
    pub secret: bool,
    /// Files to write or (content `None`) remove; others are kept.
    pub files: Vec<FileEdit>,
    pub message: String,
}

/// Change a drop: its files in one change made as the owner's delegate,
/// when any changed, and its title, description and visibility.
pub async fn update(app: &Shared, account: &Account, row: &RepoRow, u: Update) -> Result<(), DropError> {
    let (title, description) = (u.title.trim(), u.description.trim());
    check_text(title, description).map_err(DropError::Bad)?;
    if !u.files.is_empty() {
        if u.files.len() > MAX_FILES {
            return Err(bad(format!("A drop takes at most {MAX_FILES} files at a time.")));
        }
        let written: Vec<NewFile> = u
            .files
            .iter()
            .filter_map(|e| e.content.as_ref().map(|c| NewFile { name: e.path.clone(), content: String::from_utf8_lossy(c).into_owned() }))
            .collect();
        for f in &written {
            check_name(&f.name).map_err(DropError::Bad)?;
            if f.content.len() > MAX_FILE_BYTES {
                return Err(bad(format!("{} is larger than {} KiB; push larger files with oxy.", f.name, MAX_FILE_BYTES / 1024)));
            }
        }
        scan(&written).map_err(DropError::Bad)?;
        let signer = signer(app, account).await?;
        let name = RepoName::new(&row.owner, &row.name).ok_or_else(|| bad("not a drop"))?;
        let message = if u.message.trim().is_empty() {
            format!("Edit {}", if title.is_empty() { id_of(row) } else { title })
        } else {
            u.message.trim().to_string()
        };
        // Removing every file would leave an empty drop: delete it instead.
        if u.files.iter().any(|e| e.content.is_none()) {
            let (_, current) = files(app, row, "").await?;
            let left = current.iter().filter(|c| !u.files.iter().any(|e| e.path == c.path && e.content.is_none())).count();
            if left == 0 && written.is_empty() {
                return Err(bad("A drop keeps at least one file; delete the drop instead."));
            }
        }
        let b = row.default_bookmark.clone();
        let done = edits::commit(&app.repos, &name, b.clone(), b, u.files, message, signer)
            .await
            .map_err(|e| DropError::Bad(format!("The drop was not changed: {e}")))?;
        recorded(app, account, row, &done, "drop.edited", "").await;
    }
    db::repos::set_drop(&app.db, row.id, title, description, visibility(u.secret)).await?;
    if visibility(u.secret) != row.visibility() {
        db::accounts::audit(&app.db, Some(account), "drop.visibility", &row.slug(), if u.secret { "secret" } else { "public" }).await.ok();
    }
    Ok(())
}

/// The push log and the audit log for a change the hub made to a drop.
async fn recorded(app: &Shared, account: &Account, row: &RepoRow, done: &edits::Committed, action: &str, detail: &str) {
    let outcome = db::repos::PushOutcome {
        reference: done.bookmark.clone(),
        ok: true,
        reason: "web edit".into(),
        old_state: done.old_state.clone(),
        new_state: done.new_state.clone(),
        heads: done.heads.len() as i64,
        changes: 1,
    };
    db::repos::record_push(&app.db, row.id, Some((account.id, &account.username)), &[outcome]).await.ok();
    let detail = if detail.is_empty() { done.change.short(12) } else { format!("{detail} {}", done.change.short(12)) };
    db::accounts::audit(&app.db, Some(account), action, &row.slug(), &detail).await.ok();
}

/// Delete a drop: its directory to the trash and its row, once nothing
/// reads or writes it (#249), audited.
pub async fn delete(app: &Shared, actor: &Account, row: &RepoRow) -> Result<(), DropError> {
    let name = RepoName::new(&row.owner, &row.name).ok_or_else(|| bad("not a drop"))?;
    let _guard = app.repos.exclusive_guard(&name).await;
    match app.repos.trash(&name) {
        Ok(_) | Err(RepoError::NotFound) => {}
        Err(e) => return Err(e.into()),
    }
    db::repos::delete(&app.db, row.id).await?;
    db::accounts::audit(&app.db, Some(actor), "drop.deleted", &row.slug(), "moved to trash").await.ok();
    Ok(())
}

/// The drop's files at `spec` (its default bookmark when empty): every
/// file, with its text when it is text and small enough to show.
pub async fn files(app: &Shared, row: &RepoRow, spec: &str) -> Result<(crate::repos::view::RefTarget, Vec<DropFile>), RepoError> {
    let name = RepoName::new(&row.owner, &row.name).ok_or(RepoError::NotFound)?;
    let spec = if spec.is_empty() { row.default_bookmark.clone() } else { spec.to_string() };
    app.repos
        .read(&name, move |repo, cache| {
            let target = crate::repos::view::resolve(repo, cache, &spec)?;
            let loaded = cache.load(repo, &target.heads)?;
            let mut out = Vec::new();
            for (path, f) in &loaded.snapshot.files {
                let bytes = match (&f.kind, &f.content) {
                    (NodeKind::Dir, _) | (_, FileContent::Dir) => continue,
                    (_, FileContent::Text { bytes, .. }) => bytes.clone(),
                    (_, FileContent::Opaque { blobs }) => match blobs.first() {
                        Some(b) => repo.read_blob(b)?,
                        None => Vec::new(),
                    },
                };
                let size = bytes.len() as u64;
                let text = if size <= SHOWN_BYTES && !crate::repos::view::is_binary(&bytes) { String::from_utf8(bytes).ok() } else { None };
                out.push(DropFile { path: path.clone(), size, text });
            }
            Ok((target, out))
        })
        .await
}

/// The drop `id` of `owner`, or none.
pub async fn find(app: &Shared, owner: &str, id: &str) -> sqlx::Result<Option<RepoRow>> {
    let Some(name) = RepoName::drop(owner, id) else { return Ok(None) };
    Ok(db::repos::get(&app.db, &name.owner, &name.name).await?.filter(|r| r.is_drop()))
}

/// Whether `account` may change the drop: its owner alone.
pub fn may_edit(account: Option<&Account>, row: &RepoRow) -> bool {
    account.is_some_and(|a| !a.blocked() && a.username.eq_ignore_ascii_case(&row.owner))
}

/// Whether `account` may delete the drop: its owner, or a site
/// administrator.
pub fn may_delete(account: Option<&Account>, row: &RepoRow) -> bool {
    may_edit(account, row) || account.is_some_and(|a| !a.blocked() && a.is_admin)
}

/// Whether the drop is listed to `account`: public ones to everyone, secret
/// ones to their owner and site administrators only.
pub fn listed_to(account: Option<&Account>, row: &RepoRow) -> bool {
    row.visibility() == Visibility::Public || may_delete(account, row)
}

/// The edits that turn `current` text files into `wanted`: files gone are
/// removed, new or changed ones written. Files that are not text (pushed
/// with oxy) are left alone.
pub fn edits_between(current: &[DropFile], wanted: &[NewFile]) -> Vec<FileEdit> {
    let mut out = Vec::new();
    for c in current.iter().filter(|c| c.text.is_some()) {
        if !wanted.iter().any(|w| w.name == c.path) {
            out.push(FileEdit { path: c.path.clone(), content: None });
        }
    }
    for w in wanted {
        let same = current.iter().any(|c| c.path == w.name && c.text.as_deref() == Some(w.content.as_str()));
        if !same {
            out.push(FileEdit { path: w.name.clone(), content: Some(w.content.clone().into_bytes()) });
        }
    }
    out
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Drops (oxygenhub#279): small snippets of one or more files, as gists
2		//! are, each its own Oxygen repository.
3		//!
4		//! A drop is a repository named `drops/ID` under its owner, with
5		//! `repositories.kind = 'drop'`: stored, locked, cloned and pushed as any
6		//! repository is (`oxy clone https://HUB/OWNER/drops/ID`), but never
7		//! listed among repositories. Its id is 24 random hex digits, so a secret
8		//! drop's address cannot be guessed; a secret drop is `private` to every
9		//! list and readable by anyone who has the address (`auth::roles`). The
10		//! hub makes its changes as the owner's delegate, as web edits are made,
11		//! after the same push protection scan a push gets.
12
13		use crate::db::{self, accounts::Account, repos::RepoRow};
14		use crate::repos::edits::{self, Signer};
15		use crate::repos::{RepoError, RepoName};
16		use crate::Shared;
17		use hub_api::Visibility;
18		use oxy_core::objects::NodeKind;
19		use oxy_core::repo::FileEdit;
20		use oxy_core::state::FileContent;
21
22		/// Most files a drop takes from the web or the API in one go.
23		pub const MAX_FILES: usize = 50;
24		/// Largest file the web or the API takes, in bytes.
25		pub const MAX_FILE_BYTES: usize = 1 << 20;
26		/// Longest title and description.
27		pub const MAX_TITLE: usize = 200;
28		pub const MAX_DESCRIPTION: usize = 2000;
29		/// Most text a drop page shows of one file; past it, the raw link.
30		const SHOWN_BYTES: u64 = 512 * 1024;
31
32		/// Why a drop was not made or changed.
33		#[derive(Debug)]
34		pub enum DropError {
35		/// What the person can fix, said to them.
36		Bad(String),
37		Repo(RepoError),
38		Db(sqlx::Error),
39		}
40
41		impl std::fmt::Display for DropError {
42	0×	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
43	0×	match self {
44	0×	DropError::Bad(m) => f.write_str(m),
45	0×	DropError::Repo(e) => write!(f, "{e}"),
46	0×	DropError::Db(e) => write!(f, "{e}"),
47		}
48	0×	}
49		}
50
51		impl From<sqlx::Error> for DropError {
52	0×	fn from(e: sqlx::Error) -> DropError {
53	0×	DropError::Db(e)
54	0×	}
55		}
56
57		impl From<RepoError> for DropError {
58	0×	fn from(e: RepoError) -> DropError {
59	0×	DropError::Repo(e)
60	0×	}
61		}
62
63	0×	fn bad(msg: impl Into<String>) -> DropError {
64	0×	DropError::Bad(msg.into())
65	0×	}
66
67		/// `public` or `secret`, as people and the API say it.
68	16×	pub fn visibility_label(row: &RepoRow) -> &'static str {
69	16×	if row.visibility() == Visibility::Public {
70	5×	"public"
71		} else {
72	11×	"secret"
73		}
74	16×	}
75
76	9×	fn visibility(secret: bool) -> Visibility {
77	9×	if secret {
78	4×	Visibility::Private
79		} else {
80	5×	Visibility::Public
81		}
82	9×	}
83
84		/// The drop's id, from its row.
85	11×	pub fn id_of(row: &RepoRow) -> &str {
86	11×	row.name.split_once('/').map(\|(_, id)\| id).unwrap_or(&row.name)
87	11×	}
88
89		/// `/{owner}/drops/{id}`.
90	91×	pub fn url_of(row: &RepoRow) -> String {
91	91×	format!("/{}/{}", row.owner, row.name)
92	91×	}
93
94		/// The title a page shows: its own, else its first file's name, else its id.
95	36×	pub fn shown_title(row: &RepoRow, files: &[DropFile]) -> String {
96	36×	if !row.title.is_empty() {
97	33×	row.title.clone()
98	3×	} else if let Some(f) = files.first() {
99	3×	f.path.clone()
100		} else {
101	0×	id_of(row).to_string()
102		}
103	36×	}
104
105		/// One of a drop's files.
106		#[derive(Clone, Debug)]
107		pub struct DropFile {
108		pub path: String,
109		pub size: u64,
110		/// The text, when the file is text and not too large to show.
111		pub text: Option<String>,
112		}
113
114		/// A file as given from the web or the API: a name and its content.
115		#[derive(Clone, Debug)]
116		pub struct NewFile {
117		pub name: String,
118		pub content: String,
119		}
120
121		/// A file name: a path of plain parts, at most 255 bytes.
122	18×	pub fn check_name(name: &str) -> Result<String, String> {
123	18×	let name = name.trim().trim_matches('/');
124	18×	if name.is_empty() {
125	0×	return Err("Every file needs a name.".into());
126	18×	}
127	18×	if name.len() > 255 {
128	0×	return Err(format!("{name:.40}…: a file name is at most 255 bytes."));
129	18×	}
130	128×	if name.chars().any(\|c\| c.is_control() \|\| c == '\\')
131	18×	\|\| name.split('/').any(\|p\| p.is_empty() \|\| p == "." \|\| p == ".." \|\| p == oxy_core::repo::OXY_DIR \|\| p.trim() != p)
132		{
133	0×	return Err(format!("{name:?} is not a file name: use letters, digits and punctuation, with / between folders."));
134	18×	}
135	18×	Ok(name.to_string())
136	18×	}
137
138		/// Files from the web or the API, checked: named, not too many or too
139		/// large, no name twice, and nothing push protection refuses.
140	8×	pub fn check_files(files: &[NewFile], allow_empty: bool) -> Result<Vec<NewFile>, String> {
141	8×	if files.is_empty() && !allow_empty {
142	0×	return Err("A drop needs at least one file.".into());
143	8×	}
144	8×	if files.len() > MAX_FILES {
145	0×	return Err(format!("A drop takes at most {MAX_FILES} files at a time."));
146	8×	}
147	8×	let mut out: Vec<NewFile> = Vec::with_capacity(files.len());
148	13×	for f in files {
149	13×	let name = check_name(&f.name)?;
150	13×	if f.content.len() > MAX_FILE_BYTES {
151	0×	return Err(format!("{name} is larger than {} KiB; push larger files with oxy.", MAX_FILE_BYTES / 1024));
152	13×	}
153	13×	if out.iter().any(\|o\| o.name == name) {
154	0×	return Err(format!("{name} is named twice."));
155	13×	}
156		// Line endings as the browser's editor shows them.
157	13×	out.push(NewFile { name, content: f.content.replace("\r\n", "\n") });
158		}
159	8×	scan(&out)?;
160	7×	Ok(out)
161	8×	}
162
163		/// Push protection (#268) over what the hub is asked to commit: the same
164		/// rules a push gets, so a drop made on the web cannot carry what a push
165		/// would be refused for.
166	11×	pub fn scan(files: &[NewFile]) -> Result<(), String> {
167	11×	let rules = crate::push_protection::rules();
168	11×	let mut found = Vec::new();
169	16×	for f in files {
170	16×	for h in crate::push_protection::scan_text(rules, f.content.as_bytes()) {
171	2×	let rule = &rules.rules[h.rule];
172	2×	found.push(format!("{}:{}: {} (fingerprint {})", f.name, h.line, rule.description, h.fingerprint));
173	2×	}
174		}
175	11×	if found.is_empty() {
176	9×	return Ok(());
177	2×	}
178	2×	Err(format!(
179		"Push protection refused this: {} like {}, and nothing was saved. {} Take {} out (read credentials from the environment or a secret store), and if {} real, revoke or rotate {}.",
180	2×	if found.len() == 1 { "a value looks".to_string() } else { format!("{} values look", found.len()) },
181	2×	if found.len() == 1 { "a secret" } else { "secrets" },
182	2×	found.join("; "),
183	2×	if found.len() == 1 { "it" } else { "them" },
184	2×	if found.len() == 1 { "it is" } else { "one is" },
185	2×	if found.len() == 1 { "it" } else { "it as well" },
186		))
187	11×	}
188
189	9×	fn check_text(title: &str, description: &str) -> Result<(), String> {
190	9×	if title.chars().count() > MAX_TITLE {
191	0×	return Err(format!("A title is at most {MAX_TITLE} characters."));
192	9×	}
193	9×	if description.chars().count() > MAX_DESCRIPTION {
194	0×	return Err(format!("A description is at most {MAX_DESCRIPTION} characters."));
195	9×	}
196	9×	Ok(())
197	9×	}
198
199		/// The owner's signer: their identity that delegates to the hub's key.
200	8×	async fn signer(app: &Shared, account: &Account) -> Result<Signer, DropError> {
201	8×	crate::web::edit::signer_for(app, account.id).await.map_err(DropError::Bad)
202	8×	}
203
204		/// Make a drop for `account`: a new repository with the files as its first
205		/// change on `main`, authored by the account's identity and signed by the
206		/// hub as its delegate. Nothing is left behind when that fails.
207	6×	pub async fn create(
208	6×	app: &Shared,
209	6×	account: &Account,
210	6×	title: &str,
211	6×	description: &str,
212	6×	secret: bool,
213	6×	files: &[NewFile],
214	6×	) -> Result<RepoRow, DropError> {
215	6×	if account.blocked() {
216	0×	return Err(bad("This account cannot make drops."));
217	6×	}
218	6×	let (title, description) = (title.trim(), description.trim());
219	6×	check_text(title, description).map_err(DropError::Bad)?;
220	6×	let files = check_files(files, false).map_err(DropError::Bad)?;
221	6×	let signer = signer(app, account).await?;
222		// Ids are unique across the hub, so `oh drop view ID` needs no owner.
223	5×	let mut found = None;
224	5×	for _ in 0..8 {
225	5×	let id = crate::auth::random_hex(12);
226	5×	let Some(name) = RepoName::drop(&account.username, &id) else { break };
227	5×	if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
228	5×	found = Some(name);
229	5×	break;
230	0×	}
231		}
232	5×	let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
233	5×	let mut repo_id = [0u8; 16];
234	5×	rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut repo_id);
235	5×	app.repos.create_async(&name, Some(repo_id)).await?;
236	5×	let id = name.drop_id().unwrap_or_default().to_string();
237	5×	let row = match db::repos::create_drop(&app.db, &account.username, &id, title, description, visibility(secret)).await {
238	5×	Ok(row) => row,
239	0×	Err(e) => {
240	0×	let _ = std::fs::remove_dir_all(app.repos.dir(&name));
241	0×	return Err(e.into());
242		}
243		};
244	5×	let edits: Vec<FileEdit> =
245	7×	files.iter().map(\|f\| FileEdit { path: f.name.clone(), content: Some(f.content.clone().into_bytes()) }).collect();
246	5×	let message = if title.is_empty() { "Create the drop".to_string() } else { format!("Create {title}") };
247	5×	let b = row.default_bookmark.clone();
248	5×	match edits::commit(&app.repos, &name, b.clone(), b, edits, message, signer).await {
249	5×	Ok(done) => {
250	5×	recorded(app, account, &row, &done, "drop.created", visibility_label(&row)).await;
251	5×	Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
252		}
253	0×	Err(e) => {
254	0×	db::repos::delete(&app.db, row.id).await.ok();
255	0×	let _ = std::fs::remove_dir_all(app.repos.dir(&name));
256	0×	Err(DropError::Bad(format!("The drop was not made: {e}")))
257		}
258		}
259	6×	}
260
261		/// Fork `source` for `account` (#280): a new drop of theirs whose history
262		/// starts from it (its objects linked, its bookmarks copied), with its
263		/// title, description and secrecy, noting where it came from.
264	1×	pub async fn fork(app: &Shared, account: &Account, source: &RepoRow) -> Result<RepoRow, DropError> {
265	1×	if account.blocked() {
266	0×	return Err(bad("This account cannot make drops."));
267	1×	}
268	1×	let Some(from) = RepoName::new(&source.owner, &source.name) else { return Err(bad("That is not a drop.")) };
269	1×	let mut found = None;
270	1×	for _ in 0..8 {
271	1×	let id = crate::auth::random_hex(12);
272	1×	let Some(name) = RepoName::drop(&account.username, &id) else { break };
273	1×	if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
274	1×	found = Some(name);
275	1×	break;
276	0×	}
277		}
278	1×	let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
279	1×	app.repos.fork(&from, &name).await?;
280	1×	let id = name.drop_id().unwrap_or_default().to_string();
281	1×	let row = match db::repos::create_drop(&app.db, &account.username, &id, &source.title, &source.description, source.visibility()).await {
282	1×	Ok(row) => row,
283	0×	Err(e) => {
284	0×	let _ = std::fs::remove_dir_all(app.repos.dir(&name));
285	0×	return Err(e.into());
286		}
287		};
288	1×	db::repos::set_forked_from(&app.db, row.id, source.id).await?;
289	1×	db::accounts::audit(&app.db, Some(account), "drop.forked", &url_of(&row), &url_of(source)).await.ok();
290	1×	Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
291	1×	}
292
293		/// What a change to a drop's text or files is.
294		pub struct Update {
295		pub title: String,
296		pub description: String,
297		pub secret: bool,
298		/// Files to write or (content `None`) remove; others are kept.
299		pub files: Vec<FileEdit>,
300		pub message: String,
301		}
302
303		/// Change a drop: its files in one change made as the owner's delegate,
304		/// when any changed, and its title, description and visibility.
305	3×	pub async fn update(app: &Shared, account: &Account, row: &RepoRow, u: Update) -> Result<(), DropError> {
306	3×	let (title, description) = (u.title.trim(), u.description.trim());
307	3×	check_text(title, description).map_err(DropError::Bad)?;
308	3×	if !u.files.is_empty() {
309	3×	if u.files.len() > MAX_FILES {
310	0×	return Err(bad(format!("A drop takes at most {MAX_FILES} files at a time.")));
311	3×	}
312	3×	let written: Vec<NewFile> = u
313	3×	.files
314	3×	.iter()
315	3×	.filter_map(\|e\| e.content.as_ref().map(\|c\| NewFile { name: e.path.clone(), content: String::from_utf8_lossy(c).into_owned() }))
316	3×	.collect();
317	3×	for f in &written {
318	3×	check_name(&f.name).map_err(DropError::Bad)?;
319	3×	if f.content.len() > MAX_FILE_BYTES {
320	0×	return Err(bad(format!("{} is larger than {} KiB; push larger files with oxy.", f.name, MAX_FILE_BYTES / 1024)));
321	3×	}
322		}
323	3×	scan(&written).map_err(DropError::Bad)?;
324	2×	let signer = signer(app, account).await?;
325	2×	let name = RepoName::new(&row.owner, &row.name).ok_or_else(\|\| bad("not a drop"))?;
326	2×	let message = if u.message.trim().is_empty() {
327	1×	format!("Edit {}", if title.is_empty() { id_of(row) } else { title })
328		} else {
329	1×	u.message.trim().to_string()
330		};
331		// Removing every file would leave an empty drop: delete it instead.
332	2×	if u.files.iter().any(\|e\| e.content.is_none()) {
333	0×	let (_, current) = files(app, row, "").await?;
334	0×	let left = current.iter().filter(\|c\| !u.files.iter().any(\|e\| e.path == c.path && e.content.is_none())).count();
335	0×	if left == 0 && written.is_empty() {
336	0×	return Err(bad("A drop keeps at least one file; delete the drop instead."));
337	0×	}
338	2×	}
339	2×	let b = row.default_bookmark.clone();
340	2×	let done = edits::commit(&app.repos, &name, b.clone(), b, u.files, message, signer)
341	2×	.await
342	2×	.map_err(\|e\| DropError::Bad(format!("The drop was not changed: {e}")))?;
343	2×	recorded(app, account, row, &done, "drop.edited", "").await;
344	0×	}
345	2×	db::repos::set_drop(&app.db, row.id, title, description, visibility(u.secret)).await?;
346	2×	if visibility(u.secret) != row.visibility() {
347	1×	db::accounts::audit(&app.db, Some(account), "drop.visibility", &row.slug(), if u.secret { "secret" } else { "public" }).await.ok();
348	1×	}
349	2×	Ok(())
350	3×	}
351
352		/// The push log and the audit log for a change the hub made to a drop.
353	7×	async fn recorded(app: &Shared, account: &Account, row: &RepoRow, done: &edits::Committed, action: &str, detail: &str) {
354	7×	let outcome = db::repos::PushOutcome {
355	7×	reference: done.bookmark.clone(),
356	7×	ok: true,
357	7×	reason: "web edit".into(),
358	7×	old_state: done.old_state.clone(),
359	7×	new_state: done.new_state.clone(),
360	7×	heads: done.heads.len() as i64,
361	7×	changes: 1,
362	7×	};
363	7×	db::repos::record_push(&app.db, row.id, Some((account.id, &account.username)), &[outcome]).await.ok();
364	7×	let detail = if detail.is_empty() { done.change.short(12) } else { format!("{detail} {}", done.change.short(12)) };
365	7×	db::accounts::audit(&app.db, Some(account), action, &row.slug(), &detail).await.ok();
366	7×	}
367
368		/// Delete a drop: its directory to the trash and its row, once nothing
369		/// reads or writes it (#249), audited.
370	4×	pub async fn delete(app: &Shared, actor: &Account, row: &RepoRow) -> Result<(), DropError> {
371	4×	let name = RepoName::new(&row.owner, &row.name).ok_or_else(\|\| bad("not a drop"))?;
372	4×	let _guard = app.repos.exclusive_guard(&name).await;
373	4×	match app.repos.trash(&name) {
374	4×	Ok(_) \| Err(RepoError::NotFound) => {}
375	0×	Err(e) => return Err(e.into()),
376		}
377	4×	db::repos::delete(&app.db, row.id).await?;
378	4×	db::accounts::audit(&app.db, Some(actor), "drop.deleted", &row.slug(), "moved to trash").await.ok();
379	4×	Ok(())
380	4×	}
381
382		/// The drop's files at `spec` (its default bookmark when empty): every
383		/// file, with its text when it is text and small enough to show.
384	50×	pub async fn files(app: &Shared, row: &RepoRow, spec: &str) -> Result<(crate::repos::view::RefTarget, Vec<DropFile>), RepoError> {
385	50×	let name = RepoName::new(&row.owner, &row.name).ok_or(RepoError::NotFound)?;
386	50×	let spec = if spec.is_empty() { row.default_bookmark.clone() } else { spec.to_string() };
387	50×	app.repos
388	50×	.read(&name, move \|repo, cache\| {
389	50×	let target = crate::repos::view::resolve(repo, cache, &spec)?;
390	50×	let loaded = cache.load(repo, &target.heads)?;
391	50×	let mut out = Vec::new();
392	77×	for (path, f) in &loaded.snapshot.files {
393	77×	let bytes = match (&f.kind, &f.content) {
394	0×	(NodeKind::Dir, _) \| (_, FileContent::Dir) => continue,
395	77×	(_, FileContent::Text { bytes, .. }) => bytes.clone(),
396	0×	(_, FileContent::Opaque { blobs }) => match blobs.first() {
397	0×	Some(b) => repo.read_blob(b)?,
398	0×	None => Vec::new(),
399		},
400		};
401	77×	let size = bytes.len() as u64;
402	77×	let text = if size <= SHOWN_BYTES && !crate::repos::view::is_binary(&bytes) { String::from_utf8(bytes).ok() } else { None };
403	77×	out.push(DropFile { path: path.clone(), size, text });
404		}
405	50×	Ok((target, out))
406	50×	})
407	50×	.await
408	50×	}
409
410		/// The drop `id` of `owner`, or none.
411	56×	pub async fn find(app: &Shared, owner: &str, id: &str) -> sqlx::Result<Option<RepoRow>> {
412	56×	let Some(name) = RepoName::drop(owner, id) else { return Ok(None) };
413	56×	Ok(db::repos::get(&app.db, &name.owner, &name.name).await?.filter(\|r\| r.is_drop()))
414	56×	}
415
416		/// Whether `account` may change the drop: its owner alone.
417	78×	pub fn may_edit(account: Option<&Account>, row: &RepoRow) -> bool {
418	78×	account.is_some_and(\|a\| !a.blocked() && a.username.eq_ignore_ascii_case(&row.owner))
419	78×	}
420
421		/// Whether `account` may delete the drop: its owner, or a site
422		/// administrator.
423	40×	pub fn may_delete(account: Option<&Account>, row: &RepoRow) -> bool {
424	40×	may_edit(account, row) \|\| account.is_some_and(\|a\| !a.blocked() && a.is_admin)
425	40×	}
426
427		/// Whether the drop is listed to `account`: public ones to everyone, secret
428		/// ones to their owner and site administrators only.
429	14×	pub fn listed_to(account: Option<&Account>, row: &RepoRow) -> bool {
430	14×	row.visibility() == Visibility::Public \|\| may_delete(account, row)
431	14×	}
432
433		/// The edits that turn `current` text files into `wanted`: files gone are
434		/// removed, new or changed ones written. Files that are not text (pushed
435		/// with oxy) are left alone.
436	1×	pub fn edits_between(current: &[DropFile], wanted: &[NewFile]) -> Vec<FileEdit> {
437	1×	let mut out = Vec::new();
438	2×	for c in current.iter().filter(\|c\| c.text.is_some()) {
439	3×	if !wanted.iter().any(\|w\| w.name == c.path) {
440	0×	out.push(FileEdit { path: c.path.clone(), content: None });
441	2×	}
442		}
443	2×	for w in wanted {
444	3×	let same = current.iter().any(\|c\| c.path == w.name && c.text.as_deref() == Some(w.content.as_str()));
445	2×	if !same {
446	1×	out.push(FileEdit { path: w.name.clone(), content: Some(w.content.clone().into_bytes()) });
447	1×	}
448		}
449	1×	out
450	1×	}

Coverage / crates/hub/src/drops.rs 81.6%

Keyboard