| 1 | |
|
| 2 | |
|
| 3 | |
|
| 4 | |
|
| 5 | | use crate::auth::Viewer; |
| 6 | | use crate::db::accounts; |
| 7 | | use crate::levels::At; |
| 8 | | use crate::secrets::{self, Seen}; |
| 9 | | use crate::Shared; |
| 10 | | use serde::Deserialize; |
| 11 | |
|
| 12 | | #[derive(Deserialize)] |
| 13 | | pub struct SecretForm { |
| 14 | | #[serde(rename = "_csrf")] |
| 15 | | pub csrf_token: String, |
| 16 | | #[serde(default)] |
| 17 | | action: String, |
| 18 | | #[serde(default)] |
| 19 | | name: String, |
| 20 | | #[serde(default)] |
| 21 | | value: String, |
| 22 | | } |
| 23 | |
|
| 24 | | pub struct Panel { |
| 25 | | pub own: Vec<Seen>, |
| 26 | | pub inherited: Vec<Seen>, |
| 27 | | } |
| 28 | |
|
| 29 | 260× | pub async fn panel(app: &Shared, at: &At) -> sqlx::Result<Panel> { |
| 30 | 260× | let (own, inherited): (Vec<_>, Vec<_>) = |
| 31 | 260× | secrets::seen(&app.db, at.scope, &at.owner).await?.into_iter().partition(|v| v.from.is_empty()); |
| 32 | 260× | Ok(Panel { own, inherited }) |
| 33 | 260× | } |
| 34 | |
|
| 35 | |
|
| 36 | 3× | pub async fn apply(app: &Shared, viewer: &Viewer, at: &At, f: SecretForm) -> sqlx::Result<Result<String, String>> { |
| 37 | 3× | let name = f.name.trim(); |
| 38 | 3× | if !secrets::name_ok(name) { |
| 39 | 1× | return Ok(Err("A secret's name is 1 to 64 of A-Z a-z 0-9 . _ -, as the pipeline's `secret` block names it.".into())); |
| 40 | 2× | } |
| 41 | 2× | Ok(Ok(match f.action.as_str() { |
| 42 | 2× | "set" => { |
| 43 | 2× | let value = f.value.replace("\r\n", "\n"); |
| 44 | 2× | if value.is_empty() { |
| 45 | 0× | return Ok(Err("Type the secret's value.".into())); |
| 46 | 2× | } |
| 47 | 2× | if value.len() > secrets::MAX_VALUE { |
| 48 | 0× | return Ok(Err(format!("A value is up to {} bytes.", secrets::MAX_VALUE))); |
| 49 | 2× | } |
| 50 | 2× | let own = secrets::list(&app.db, at.scope).await?; |
| 51 | 2× | if own.len() >= secrets::MAX_PER_LEVEL && !own.iter().any(|s| s.name == name) { |
| 52 | 0× | return Ok(Err(format!("Up to {} secrets here.", secrets::MAX_PER_LEVEL))); |
| 53 | 2× | } |
| 54 | 2× | secrets::set(&app.db, at.scope, name, &app.secret_key.seal(&value)).await?; |
| 55 | 2× | accounts::audit(&app.db, viewer.account(), "flow.secret.set", &at.label, name).await.ok(); |
| 56 | 2× | format!("{name} set.") |
| 57 | | } |
| 58 | 0× | "delete" => { |
| 59 | 0× | if !secrets::delete(&app.db, at.scope, name).await? { |
| 60 | 0× | return Ok(Err(format!("There is no secret {name} here."))); |
| 61 | 0× | } |
| 62 | 0× | accounts::audit(&app.db, viewer.account(), "flow.secret.deleted", &at.label, name).await.ok(); |
| 63 | 0× | format!("{name} removed.") |
| 64 | | } |
| 65 | 0× | _ => return Ok(Err("Unknown action.".into())), |
| 66 | | })) |
| 67 | 3× | } |