Coverage / crates/hub/src/terraform.rs 85.3%

    fn label(&self) -> String {

        match self {

            Who::Job { name } => name.clone(),

    }

    fn may(&self, access: Access) -> bool {

        match self {

            Who::Job { .. } => true,

            Who::Person { role, .. } => crate::auth::roles::allows(Some(*role), access),

    }

fn err(status: StatusCode, why: impl Into<String>) -> ApiError {

    ApiError(status, why.into())

}

fn token_of(headers: &HeaderMap) -> Option<String> {

    if let Some(t) = oxy_server::bearer_token(headers) {

        return Some(t.to_string());

    }

    let v = headers.get(header::AUTHORIZATION)?.to_str().ok()?;

    let b64 = v.strip_prefix("Basic ").or_else(|| v.strip_prefix("basic "))?;

    let raw = String::from_utf8(oxy_core::dsse::base64_decode(b64.trim())?).ok()?;

    let (_, password) = raw.split_once(':')?;

    (!password.is_empty()).then(|| password.to_string())

}

pub fn audience(base_url: &str) -> String {

    format!("{}/terraform", base_url.trim_end_matches('/'))

}

fn valid_name(name: &str) -> bool {

    !name.is_empty()

        && name.len() <= 100

        && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')

        && !name.starts_with('.')

}

async fn who(app: &Shared, headers: &HeaderMap, row: &db::repos::RepoRow) -> Result<Who, ApiError> {

    let token = token_of(headers).ok_or_else(|| {

        err(StatusCode::UNAUTHORIZED, "a Terraform state needs a token: a job's (TF_HTTP_PASSWORD), or one of yours with repo:write")

    })?;

    let hash = crate::auth::token_hash(&token);

    if token.starts_with(crate::flow::JOB_TOKEN_PREFIX) {

        let job = db::flow::job_by_token(&app.db, &hash, crate::flow::JOB_TOKEN_MAX_AGE_MS)

            .await

            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid (the job must be running)"))?;

        let run = db::flow::run_by_id(&app.db, job.run_id)

            .await

            .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

            .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "this job token is not valid"))?;

        if run.repo_id != row.id {

            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));

        }

        return Ok(Who::Job { name: format!("run #{} {}", run.number, job.name) });

    }

    let personal = db::accounts::token_by_hash(&app.db, &hash).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let Some(token) = personal.filter(|t| !t.expired(db::now_ms())) else {

        let issuer = app.oidc().await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

        let aud = audience(app.config.base_url());

        let Some(claims) = issuer.verify(&token, &aud, db::now_ms()) else {

            return Err(err(StatusCode::UNAUTHORIZED, format!("unknown or expired token (a job's identity token must be for {aud})")));

        let sub = claims["sub"].as_str().unwrap_or("");

        let repo = claims["repository"]

            .as_str()

            .map(String::from)

            .or_else(|| sub.strip_prefix("repo:").and_then(|r| r.split_once(":bookmark:")).map(|(r, _)| r.to_string()));

        if repo.as_deref() != Some(row.slug().as_str()) {

            return Err(err(StatusCode::FORBIDDEN, "a job keeps the states of its own repository only"));

        }

        return Ok(Who::Job { name: sub.to_string() });

    if !(token.has_scope("repo:write") || token.has_scope("repo:admin")) {

    }

    let slug = row.slug();

    if !token.covers(&slug) {

    }

    let account = db::accounts::account_by_id(&app.db, token.account_id)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .filter(|a| !a.banned && !a.disabled)

        .ok_or_else(|| err(StatusCode::UNAUTHORIZED, "unknown token"))?;

    let role = crate::auth::roles::role_for(&app.db, Some(&account), row)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    match role {

        Some(r) if crate::auth::roles::allows(Some(r), Access::Read) => Ok(Who::Person { account: Box::new(account), role: r }),

}

fn json(status: StatusCode, body: String) -> Response {

    (status, [(header::CONTENT_TYPE, "application/json")], body).into_response()

}

fn lock_id(info: &[u8]) -> Option<String> {

    serde_json::from_slice::<serde_json::Value>(info).ok()?.get("ID")?.as_str().map(String::from)

}

    pub fn message(&self) -> String {

        match self {

            RestoreError::NotFound => "no such version of this state".into(),

            RestoreError::Locked(by) => format!("the state is locked by {by}: restore it once the lock is released"),

    }

    fn status(&self) -> StatusCode {

        match self {

            RestoreError::NotFound => StatusCode::NOT_FOUND,

            RestoreError::Locked(_) => StatusCode::LOCKED,

    }

pub async fn restore(app: &Shared, repo_id: i64, state: &str, id: i64, by: &str) -> Result<i64, RestoreError> {

    let current = db::terraform::get(&app.db, repo_id, state).await.map_err(RestoreError::Db)?;

    if let Some(l) = current.as_ref().filter(|s| !s.lock_id.is_empty()) {

        return Err(RestoreError::Locked(l.locked_by.clone()));

    }

    let (body, old_serial) =

        db::terraform::version_body(&app.db, repo_id, state, id).await.map_err(RestoreError::Db)?.ok_or(RestoreError::NotFound)?;

    let plain = app.secret_key.open(&body).ok_or(RestoreError::Broken)?;

    let mut json: serde_json::Value = serde_json::from_str(&plain).map_err(|_| RestoreError::Broken)?;

    let serial = current.map_or(0, |c| c.serial).max(old_serial) + 1;

    json["serial"] = serial.into();

    let text = serde_json::to_string_pretty(&json).map_err(|_| RestoreError::Broken)?;

    let label = format!("{by}, restoring serial {old_serial}");

    db::terraform::put(&app.db, repo_id, state, &app.secret_key.seal(&text), serial, &label, VERSIONS_KEPT)

        .await

        .map_err(RestoreError::Db)?;

    Ok(serial)

}

pub async fn versions(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state)): Path<(String, String, String)>,

) -> Result<Response, ApiError> {

    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;

    let list =

        db::terraform::version_list(&app.db, row.id, &state).await.map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    let out: Vec<serde_json::Value> = list

        .iter()

        .map(|v| serde_json::json!({ "id": v.id, "serial": v.serial, "written_by": v.created_by, "written_ms": v.created_ms }))

        .collect();

    Ok(json(StatusCode::OK, serde_json::Value::Array(out).to_string()))

}

pub async fn version(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state, id)): Path<(String, String, String, i64)>,

) -> Result<Response, ApiError> {

    let (row, _who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Write).await?;

    let (body, _) = db::terraform::version_body(&app.db, row.id, &state, id)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such version of this state"))?;

    let plain = app.secret_key.open(&body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the version does not open"))?;

    Ok(json(StatusCode::OK, plain))

}

pub async fn restore_version(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name, state, id)): Path<(String, String, String, i64)>,

) -> Result<Response, ApiError> {

    let (row, who) = versions_caller(&app, &headers, &owner, &name, &state, Access::Maintain).await?;

    let Who::Person { account, .. } = &who else {

        return Err(err(StatusCode::FORBIDDEN, "a job does not restore a state: a person with the maintain role does"));

    let serial = restore(&app, row.id, &state, id, &account.username).await.map_err(|e| err(e.status(), e.message()))?;

    db::accounts::audit(

        &app.db,

        Some(account),

        "terraform.restored",

        &format!("{}:{state}", row.slug()),

        &format!("version {id}, now serial {serial}"),

    )

    .await

    .ok();

    Ok(json(StatusCode::OK, serde_json::json!({ "serial": serial }).to_string()))

}

async fn versions_caller(

    app: &Shared,

    headers: &HeaderMap,

    owner: &str,

    name: &str,

    state: &str,

    access: Access,

) -> Result<(db::repos::RepoRow, Who), ApiError> {

    if !valid_name(state) {

    }

    let row = db::repos::get(&app.db, owner, name)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;

    let who = who(app, headers, &row).await?;

    if !who.may(access) {

        return Err(err(

            if access == Access::Maintain { "restoring a state needs the maintain role" } else { "a Terraform state needs the write role" },

    }

    Ok((row, who))

}

pub async fn state(

    State(app): State<Shared>,

    method: Method,

    headers: HeaderMap,

    Path((owner, name, state)): Path<(String, String, String)>,

    Query(q): Query<LockQuery>,

    body: Bytes,

) -> Result<Response, ApiError> {

    if !valid_name(&state) {

        return Err(err(StatusCode::BAD_REQUEST, "a state's name is letters, digits, '-', '_' and '.', up to 100"));

    }

    let row = db::repos::get(&app.db, &owner, &name)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;

    let who = who(&app, &headers, &row).await?;

    if !who.may(Access::Write) {

        return Err(err(StatusCode::FORBIDDEN, "a Terraform state needs the write role on its repository: states hold secrets"));

    }

    let db_err = |e: sqlx::Error| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string());

    let current = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;

    let locked = current.as_ref().filter(|s| !s.lock_id.is_empty());

    match method.as_str() {

        "GET" => match current.filter(|s| !s.body.is_empty()) {

            Some(s) => {

                let plain =

                    app.secret_key.open(&s.body).ok_or_else(|| err(StatusCode::INTERNAL_SERVER_ERROR, "the state does not open"))?;

                Ok(json(StatusCode::OK, plain))

            None => Ok(StatusCode::NO_CONTENT.into_response()),

        "POST" => {

            if body.len() > MAX_STATE_BYTES {

            }

            let text = std::str::from_utf8(&body).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;

            let parsed: serde_json::Value = serde_json::from_str(text).map_err(|_| err(StatusCode::BAD_REQUEST, "a state is JSON"))?;

            if let Some(l) = locked {

                if q.id.as_deref() != Some(l.lock_id.as_str()) {

                    return Ok(json(StatusCode::LOCKED, l.lock_info.clone()));

                }

            }

            let serial = parsed.get("serial").and_then(|v| v.as_i64()).unwrap_or(0);

            let sealed = app.secret_key.seal(text);

            db::terraform::put(&app.db, row.id, &state, &sealed, serial, &who.label(), VERSIONS_KEPT).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

        "DELETE" => {

        "LOCK" => {

            let info = std::str::from_utf8(&body).unwrap_or("");

            let Some(id) = lock_id(body.as_ref()) else {

            if let Some(l) = locked {

                return Ok(json(if l.lock_id == id { StatusCode::OK } else { StatusCode::LOCKED }, l.lock_info.clone()));

            }

            if db::terraform::lock(&app.db, row.id, &state, &id, info, &who.label()).await.map_err(db_err)? {

                Ok(json(StatusCode::OK, info.to_string()))

        "UNLOCK" => {

            let Some(l) = locked else { return Ok(StatusCode::OK.into_response()) };

            let id = lock_id(body.as_ref()).or(q.id.clone());

            if id.as_deref() != Some(l.lock_id.as_str()) {

                return Ok(json(StatusCode::CONFLICT, l.lock_info.clone()));

            }

            db::terraform::unlock(&app.db, row.id, &state).await.map_err(db_err)?;

            Ok(StatusCode::OK.into_response())

}