drops.rs 83.7%

287 of 343 lines run, 48 of 114 functions · run #544 on main · run missed

//! Drops (oxygenhub#279): small snippets of one or more files, as gists
//! are, each its own Oxygen repository.
//!
//! A drop is a repository named `drops/ID` under its owner, with
//! `repositories.kind = 'drop'`: stored, locked, cloned and pushed as any
//! repository is (`oxy clone https://HUB/OWNER/drops/ID`), but never
//! listed among repositories. Its id is 24 random hex digits, so a secret
//! drop's address cannot be guessed; a secret drop is `private` to every
//! list and readable by anyone who has the address (`auth::roles`). The
//! hub makes its changes as the owner's delegate, as web edits are made,
//! after the same push protection scan a push gets.

use crate::db::{self, accounts::Account, repos::RepoRow};
use crate::repos::edits::{self, Signer};
use crate::repos::{RepoError, RepoName};
use crate::Shared;
use hub_api::Visibility;
use oxy_core::objects::NodeKind;
use oxy_core::repo::FileEdit;
use oxy_core::state::FileContent;

/// Most files a drop takes from the web or the API in one go.
pub const MAX_FILES: usize = 50;
/// Largest file the web or the API takes, in bytes.
pub const MAX_FILE_BYTES: usize = 1 << 20;
/// Longest title and description.
pub const MAX_TITLE: usize = 200;
pub const MAX_DESCRIPTION: usize = 2000;
/// Most text a drop page shows of one file; past it, the raw link.
const SHOWN_BYTES: u64 = 512 * 1024;

/// Why a drop was not made or changed.
#[derive(Debug)]
pub enum DropError {
    /// What the person can fix, said to them.
    Bad(String),
    Repo(RepoError),
    Db(sqlx::Error),
}

impl std::fmt::Display for DropError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            DropError::Bad(m) => f.write_str(m),
            DropError::Repo(e) => write!(f, "{e}"),
            DropError::Db(e) => write!(f, "{e}"),
        }
    }
}

impl From<sqlx::Error> for DropError {
    fn from(e: sqlx::Error) -> DropError {
        DropError::Db(e)
    }
}

impl From<RepoError> for DropError {
    fn from(e: RepoError) -> DropError {
        DropError::Repo(e)
    }
}

fn bad(msg: impl Into<String>) -> DropError {
    DropError::Bad(msg.into())
}

/// `public` or `secret`, as people and the API say it.
pub fn visibility_label(row: &RepoRow) -> &'static str {
    if row.visibility() == Visibility::Public {
        "public"
    } else {
        "secret"
    }
}

fn visibility(secret: bool) -> Visibility {
    if secret {
        Visibility::Private
    } else {
        Visibility::Public
    }
}

/// The drop's id, from its row.
pub fn id_of(row: &RepoRow) -> &str {
    row.name.split_once('/').map(|(_, id)| id).unwrap_or(&row.name)
}

/// `/{owner}/drops/{id}`.
pub fn url_of(row: &RepoRow) -> String {
    format!("/{}/{}", row.owner, row.name)
}

/// The title a page shows: its own, else its first file's name, else its id.
pub fn shown_title(row: &RepoRow, files: &[DropFile]) -> String {
    if !row.title.is_empty() {
        row.title.clone()
    } else if let Some(f) = files.first() {
        f.path.clone()
    } else {
        id_of(row).to_string()
    }
}

/// One of a drop's files.
#[derive(Clone, Debug)]
pub struct DropFile {
    pub path: String,
    pub size: u64,
    /// The text, when the file is text and not too large to show.
    pub text: Option<String>,
}

/// A file as given from the web or the API: a name and its content.
#[derive(Clone, Debug)]
pub struct NewFile {
    pub name: String,
    pub content: String,
}

/// A file name: a path of plain parts, at most 255 bytes.
pub fn check_name(name: &str) -> Result<String, String> {
    let name = name.trim().trim_matches('/');
    if name.is_empty() {
        return Err("Every file needs a name.".into());
    }
    if name.len() > 255 {
        return Err(format!("{name:.40}…: a file name is at most 255 bytes."));
    }
    if name.chars().any(|c| c.is_control() || c == '\\')
        || name.split('/').any(|p| p.is_empty() || p == "." || p == ".." || p == oxy_core::repo::OXY_DIR || p.trim() != p)
    {
        return Err(format!("{name:?} is not a file name: use letters, digits and punctuation, with / between folders."));
    }
    Ok(name.to_string())
}

/// Files from the web or the API, checked: named, not too many or too
/// large, no name twice, and nothing push protection refuses.
pub fn check_files(files: &[NewFile], allow_empty: bool) -> Result<Vec<NewFile>, String> {
    if files.is_empty() && !allow_empty {
        return Err("A drop needs at least one file.".into());
    }
    if files.len() > MAX_FILES {
        return Err(format!("A drop takes at most {MAX_FILES} files at a time."));
    }
    let mut out: Vec<NewFile> = Vec::with_capacity(files.len());
    for f in files {
        let name = check_name(&f.name)?;
        if f.content.len() > MAX_FILE_BYTES {
            return Err(format!("{name} is larger than {} KiB; push larger files with oxy.", MAX_FILE_BYTES / 1024));
        }
        if out.iter().any(|o| o.name == name) {
            return Err(format!("{name} is named twice."));
        }
        // Line endings as the browser's editor shows them.
        out.push(NewFile { name, content: f.content.replace("\r\n", "\n") });
    }
    scan(&out)?;
    Ok(out)
}

/// Push protection (#268) over what the hub is asked to commit: the same
/// rules a push gets, so a drop made on the web cannot carry what a push
/// would be refused for.
pub fn scan(files: &[NewFile]) -> Result<(), String> {
    let rules = crate::push_protection::rules();
    let mut found = Vec::new();
    for f in files {
        for h in crate::push_protection::scan_text(rules, f.content.as_bytes()) {
            let rule = &rules.rules[h.rule];
            found.push(format!("{}:{}: {} (fingerprint {})", f.name, h.line, rule.description, h.fingerprint));
        }
    }
    if found.is_empty() {
        return Ok(());
    }
    Err(format!(
        "Push protection refused this: {} like {}, and nothing was saved. {} Take {} out (read credentials from the environment or a secret store), and if {} real, revoke or rotate {}.",
        if found.len() == 1 { "a value looks".to_string() } else { format!("{} values look", found.len()) },
        if found.len() == 1 { "a secret" } else { "secrets" },
        found.join("; "),
        if found.len() == 1 { "it" } else { "them" },
        if found.len() == 1 { "it is" } else { "one is" },
        if found.len() == 1 { "it" } else { "it as well" },
    ))
}

fn check_text(title: &str, description: &str) -> Result<(), String> {
    if title.chars().count() > MAX_TITLE {
        return Err(format!("A title is at most {MAX_TITLE} characters."));
    }
    if description.chars().count() > MAX_DESCRIPTION {
        return Err(format!("A description is at most {MAX_DESCRIPTION} characters."));
    }
    Ok(())
}

/// The owner's signer: their identity that delegates to the hub's key.
async fn signer(app: &Shared, account: &Account) -> Result<Signer, DropError> {
    crate::web::edit::signer_for(app, account.id).await.map_err(DropError::Bad)
}

/// Make a drop for `account`: a new repository with the files as its first
/// change on `main`, authored by the account's identity and signed by the
/// hub as its delegate. Nothing is left behind when that fails.
pub async fn create(
    app: &Shared,
    account: &Account,
    title: &str,
    description: &str,
    secret: bool,
    files: &[NewFile],
) -> Result<RepoRow, DropError> {
    if account.blocked() {
        return Err(bad("This account cannot make drops."));
    }
    let (title, description) = (title.trim(), description.trim());
    check_text(title, description).map_err(DropError::Bad)?;
    let files = check_files(files, false).map_err(DropError::Bad)?;
    let signer = signer(app, account).await?;
    // Ids are unique across the hub, so `oh drop view ID` needs no owner.
    let mut found = None;
    for _ in 0..8 {
        let id = crate::auth::random_hex(12);
        let Some(name) = RepoName::drop(&account.username, &id) else { break };
        if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
            found = Some(name);
            break;
        }
    }
    let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
    let mut repo_id = [0u8; 16];
    rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut repo_id);
    app.repos.create_async(&name, Some(repo_id)).await?;
    let id = name.drop_id().unwrap_or_default().to_string();
    let row = match db::repos::create_drop(&app.db, &account.username, &id, title, description, visibility(secret)).await {
        Ok(row) => row,
        Err(e) => {
            let _ = std::fs::remove_dir_all(app.repos.dir(&name));
            return Err(e.into());
        }
    };
    let edits: Vec<FileEdit> =
        files.iter().map(|f| FileEdit { path: f.name.clone(), content: Some(f.content.clone().into_bytes()) }).collect();
    let message = if title.is_empty() { "Create the drop".to_string() } else { format!("Create {title}") };
    let b = row.default_bookmark.clone();
    match edits::commit(&app.repos, &name, b.clone(), b, edits, message, signer).await {
        Ok(done) => {
            recorded(app, account, &row, &done, "drop.created", visibility_label(&row)).await;
            Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
        }
        Err(e) => {
            db::repos::delete(&app.db, row.id).await.ok();
            let _ = std::fs::remove_dir_all(app.repos.dir(&name));
            Err(DropError::Bad(format!("The drop was not made: {e}")))
        }
    }
}

/// Fork `source` for `account` (#280): a new drop of theirs whose history
/// starts from it (its objects linked, its bookmarks copied), with its
/// title, description and secrecy, noting where it came from.
pub async fn fork(app: &Shared, account: &Account, source: &RepoRow) -> Result<RepoRow, DropError> {
    if account.blocked() {
        return Err(bad("This account cannot make drops."));
    }
    let Some(from) = RepoName::new(&source.owner, &source.name) else { return Err(bad("That is not a drop.")) };
    let mut found = None;
    for _ in 0..8 {
        let id = crate::auth::random_hex(12);
        let Some(name) = RepoName::drop(&account.username, &id) else { break };
        if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
            found = Some(name);
            break;
        }
    }
    let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
    app.repos.fork(&from, &name).await?;
    let id = name.drop_id().unwrap_or_default().to_string();
    let row = match db::repos::create_drop(&app.db, &account.username, &id, &source.title, &source.description, source.visibility()).await {
        Ok(row) => row,
        Err(e) => {
            let _ = std::fs::remove_dir_all(app.repos.dir(&name));
            return Err(e.into());
        }
    };
    db::repos::set_forked_from(&app.db, row.id, source.id).await?;
    db::accounts::audit(&app.db, Some(account), "drop.forked", &url_of(&row), &url_of(source)).await.ok();
    Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
}

/// The longest comment on a drop, in bytes.
pub const COMMENT_MAX: usize = 64 * 1024;

/// `account` comments on `row` (#280, oxygenhub#349): some Markdown, at most
/// [`COMMENT_MAX`]; the drop's owner is told. The comment's number.
pub async fn add_comment(app: &Shared, account: &Account, row: &RepoRow, body: &str) -> Result<i64, DropError> {
    let body = body.trim();
    if body.is_empty() || body.len() > COMMENT_MAX || account.blocked() {
        return Err(bad("A comment is some text, at most 64 KiB."));
    }
    let n = db::repos::add_drop_comment(&app.db, row.id, account.id, &account.username, body).await?;
    if account.username != row.owner {
        if let Ok(Some(owner)) = db::accounts::account_by_name(&app.db, &row.owner).await {
            let title = format!("{} on your drop {}", account.username, shown_title(row, &[]));
            crate::notify::tell(
                app,
                "drop.comment",
                &title,
                &format!("{}#comment-{n}", url_of(row)),
                &account.username,
                Some(row.id),
                vec![(owner.id, db::notify::Reason::Participating)],
            )
            .await;
        }
    }
    Ok(n)
}

/// Whether `account` may delete comment `c` on `row`: its author, the
/// drop's owner or a site administrator.
pub fn may_delete_comment(account: Option<&Account>, row: &RepoRow, c: &db::repos::DropComment) -> bool {
    account.is_some_and(|a| !a.blocked() && (Some(a.id) == c.author_id || a.username == row.owner || a.is_admin))
}

/// What a change to a drop's text or files is.
pub struct Update {
    pub title: String,
    pub description: String,
    pub secret: bool,
    /// Files to write or (content `None`) remove; others are kept.
    pub files: Vec<FileEdit>,
    pub message: String,
}

/// Change a drop: its files in one change made as the owner's delegate,
/// when any changed, and its title, description and visibility.
pub async fn update(app: &Shared, account: &Account, row: &RepoRow, u: Update) -> Result<(), DropError> {
    let (title, description) = (u.title.trim(), u.description.trim());
    check_text(title, description).map_err(DropError::Bad)?;
    if !u.files.is_empty() {
        if u.files.len() > MAX_FILES {
            return Err(bad(format!("A drop takes at most {MAX_FILES} files at a time.")));
        }
        let written: Vec<NewFile> = u
            .files
            .iter()
            .filter_map(|e| e.content.as_ref().map(|c| NewFile { name: e.path.clone(), content: String::from_utf8_lossy(c).into_owned() }))
            .collect();
        for f in &written {
            check_name(&f.name).map_err(DropError::Bad)?;
            if f.content.len() > MAX_FILE_BYTES {
                return Err(bad(format!("{} is larger than {} KiB; push larger files with oxy.", f.name, MAX_FILE_BYTES / 1024)));
            }
        }
        scan(&written).map_err(DropError::Bad)?;
        let signer = signer(app, account).await?;
        let name = RepoName::new(&row.owner, &row.name).ok_or_else(|| bad("not a drop"))?;
        let message = if u.message.trim().is_empty() {
            format!("Edit {}", if title.is_empty() { id_of(row) } else { title })
        } else {
            u.message.trim().to_string()
        };
        // Removing every file would leave an empty drop: delete it instead.
        if u.files.iter().any(|e| e.content.is_none()) {
            let (_, current) = files(app, row, "").await?;
            let left = current.iter().filter(|c| !u.files.iter().any(|e| e.path == c.path && e.content.is_none())).count();
            if left == 0 && written.is_empty() {
                return Err(bad("A drop keeps at least one file; delete the drop instead."));
            }
        }
        let b = row.default_bookmark.clone();
        let done = edits::commit(&app.repos, &name, b.clone(), b, u.files, message, signer)
            .await
            .map_err(|e| DropError::Bad(format!("The drop was not changed: {e}")))?;
        recorded(app, account, row, &done, "drop.edited", "").await;
    }
    db::repos::set_drop(&app.db, row.id, title, description, visibility(u.secret)).await?;
    if visibility(u.secret) != row.visibility() {
        db::accounts::audit(&app.db, Some(account), "drop.visibility", &row.slug(), if u.secret { "secret" } else { "public" }).await.ok();
    }
    Ok(())
}

/// The push log and the audit log for a change the hub made to a drop.
async fn recorded(app: &Shared, account: &Account, row: &RepoRow, done: &edits::Committed, action: &str, detail: &str) {
    let outcome = db::repos::PushOutcome {
        reference: done.bookmark.clone(),
        ok: true,
        reason: "web edit".into(),
        old_state: done.old_state.clone(),
        new_state: done.new_state.clone(),
        heads: done.heads.len() as i64,
        changes: 1,
    };
    db::repos::record_push(&app.db, row.id, Some((account.id, &account.username)), &[outcome]).await.ok();
    let detail = if detail.is_empty() { done.change.short(12) } else { format!("{detail} {}", done.change.short(12)) };
    db::accounts::audit(&app.db, Some(account), action, &row.slug(), &detail).await.ok();
}

/// Delete a drop: its directory to the trash and its row, once nothing
/// reads or writes it (#249), audited.
pub async fn delete(app: &Shared, actor: &Account, row: &RepoRow) -> Result<(), DropError> {
    let name = RepoName::new(&row.owner, &row.name).ok_or_else(|| bad("not a drop"))?;
    let _guard = app.repos.exclusive_guard(&name).await;
    match app.repos.trash(&name) {
        Ok(_) | Err(RepoError::NotFound) => {}
        Err(e) => return Err(e.into()),
    }
    db::repos::delete(&app.db, row.id).await?;
    db::accounts::audit(&app.db, Some(actor), "drop.deleted", &row.slug(), "moved to trash").await.ok();
    Ok(())
}

/// The drop's files at `spec` (its default bookmark when empty): every
/// file, with its text when it is text and small enough to show.
pub async fn files(app: &Shared, row: &RepoRow, spec: &str) -> Result<(crate::repos::view::RefTarget, Vec<DropFile>), RepoError> {
    let name = RepoName::new(&row.owner, &row.name).ok_or(RepoError::NotFound)?;
    let spec = if spec.is_empty() { row.default_bookmark.clone() } else { spec.to_string() };
    app.repos
        .read(&name, move |repo, cache| {
            let target = crate::repos::view::resolve(repo, cache, &spec)?;
            let loaded = cache.load(repo, &target.heads)?;
            let mut out = Vec::new();
            for (path, f) in &loaded.snapshot.files {
                let bytes = match (&f.kind, &f.content) {
                    (NodeKind::Dir, _) | (_, FileContent::Dir) => continue,
                    (_, FileContent::Text { bytes, .. }) => bytes.clone(),
                    (_, FileContent::Opaque { blobs }) => match blobs.first() {
                        Some(b) => repo.read_blob(b)?,
                        None => Vec::new(),
                    },
                };
                let size = bytes.len() as u64;
                let text = if size <= SHOWN_BYTES && !crate::repos::view::is_binary(&bytes) { String::from_utf8(bytes).ok() } else { None };
                out.push(DropFile { path: path.clone(), size, text });
            }
            Ok((target, out))
        })
        .await
}

/// The drop `id` of `owner`, or none.
pub async fn find(app: &Shared, owner: &str, id: &str) -> sqlx::Result<Option<RepoRow>> {
    let Some(name) = RepoName::drop(owner, id) else { return Ok(None) };
    Ok(db::repos::get(&app.db, &name.owner, &name.name).await?.filter(|r| r.is_drop()))
}

/// Whether `account` may change the drop: its owner alone.
pub fn may_edit(account: Option<&Account>, row: &RepoRow) -> bool {
    account.is_some_and(|a| !a.blocked() && a.username.eq_ignore_ascii_case(&row.owner))
}

/// Whether `account` may delete the drop: its owner, or a site
/// administrator.
pub fn may_delete(account: Option<&Account>, row: &RepoRow) -> bool {
    may_edit(account, row) || account.is_some_and(|a| !a.blocked() && a.is_admin)
}

/// Whether the drop is listed to `account`: public ones to everyone, secret
/// ones to their owner and site administrators only.
pub fn listed_to(account: Option<&Account>, row: &RepoRow) -> bool {
    row.visibility() == Visibility::Public || may_delete(account, row)
}

/// The edits that turn `current` text files into `wanted`: files gone are
/// removed, new or changed ones written. Files that are not text (pushed
/// with oxy) are left alone.
pub fn edits_between(current: &[DropFile], wanted: &[NewFile]) -> Vec<FileEdit> {
    let mut out = Vec::new();
    for c in current.iter().filter(|c| c.text.is_some()) {
        if !wanted.iter().any(|w| w.name == c.path) {
            out.push(FileEdit { path: c.path.clone(), content: None });
        }
    }
    for w in wanted {
        let same = current.iter().any(|c| c.path == w.name && c.text.as_deref() == Some(w.content.as_str()));
        if !same {
            out.push(FileEdit { path: w.name.clone(), content: Some(w.content.clone().into_bytes()) });
        }
    }
    out
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Drops (oxygenhub#279): small snippets of one or more files, as gists
2		//! are, each its own Oxygen repository.
3		//!
4		//! A drop is a repository named `drops/ID` under its owner, with
5		//! `repositories.kind = 'drop'`: stored, locked, cloned and pushed as any
6		//! repository is (`oxy clone https://HUB/OWNER/drops/ID`), but never
7		//! listed among repositories. Its id is 24 random hex digits, so a secret
8		//! drop's address cannot be guessed; a secret drop is `private` to every
9		//! list and readable by anyone who has the address (`auth::roles`). The
10		//! hub makes its changes as the owner's delegate, as web edits are made,
11		//! after the same push protection scan a push gets.
12
13		use crate::db::{self, accounts::Account, repos::RepoRow};
14		use crate::repos::edits::{self, Signer};
15		use crate::repos::{RepoError, RepoName};
16		use crate::Shared;
17		use hub_api::Visibility;
18		use oxy_core::objects::NodeKind;
19		use oxy_core::repo::FileEdit;
20		use oxy_core::state::FileContent;
21
22		/// Most files a drop takes from the web or the API in one go.
23		pub const MAX_FILES: usize = 50;
24		/// Largest file the web or the API takes, in bytes.
25		pub const MAX_FILE_BYTES: usize = 1 << 20;
26		/// Longest title and description.
27		pub const MAX_TITLE: usize = 200;
28		pub const MAX_DESCRIPTION: usize = 2000;
29		/// Most text a drop page shows of one file; past it, the raw link.
30		const SHOWN_BYTES: u64 = 512 * 1024;
31
32		/// Why a drop was not made or changed.
33		#[derive(Debug)]
34		pub enum DropError {
35		/// What the person can fix, said to them.
36		Bad(String),
37		Repo(RepoError),
38		Db(sqlx::Error),
39		}
40
41		impl std::fmt::Display for DropError {
42	0×	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
43	0×	match self {
44	0×	DropError::Bad(m) => f.write_str(m),
45	0×	DropError::Repo(e) => write!(f, "{e}"),
46	0×	DropError::Db(e) => write!(f, "{e}"),
47		}
48	0×	}
49		}
50
51		impl From<sqlx::Error> for DropError {
52	0×	fn from(e: sqlx::Error) -> DropError {
53	0×	DropError::Db(e)
54	0×	}
55		}
56
57		impl From<RepoError> for DropError {
58	0×	fn from(e: RepoError) -> DropError {
59	0×	DropError::Repo(e)
60	0×	}
61		}
62
63	1×	fn bad(msg: impl Into<String>) -> DropError {
64	1×	DropError::Bad(msg.into())
65	1×	}
66
67		/// `public` or `secret`, as people and the API say it.
68	20×	pub fn visibility_label(row: &RepoRow) -> &'static str {
69	20×	if row.visibility() == Visibility::Public {
70	9×	"public"
71		} else {
72	11×	"secret"
73		}
74	20×	}
75
76	10×	fn visibility(secret: bool) -> Visibility {
77	10×	if secret {
78	4×	Visibility::Private
79		} else {
80	6×	Visibility::Public
81		}
82	10×	}
83
84		/// The drop's id, from its row.
85	14×	pub fn id_of(row: &RepoRow) -> &str {
86	14×	row.name.split_once('/').map(\|(_, id)\| id).unwrap_or(&row.name)
87	14×	}
88
89		/// `/{owner}/drops/{id}`.
90	100×	pub fn url_of(row: &RepoRow) -> String {
91	100×	format!("/{}/{}", row.owner, row.name)
92	100×	}
93
94		/// The title a page shows: its own, else its first file's name, else its id.
95	38×	pub fn shown_title(row: &RepoRow, files: &[DropFile]) -> String {
96	38×	if !row.title.is_empty() {
97	35×	row.title.clone()
98	3×	} else if let Some(f) = files.first() {
99	3×	f.path.clone()
100		} else {
101	0×	id_of(row).to_string()
102		}
103	38×	}
104
105		/// One of a drop's files.
106		#[derive(Clone, Debug)]
107		pub struct DropFile {
108		pub path: String,
109		pub size: u64,
110		/// The text, when the file is text and not too large to show.
111		pub text: Option<String>,
112		}
113
114		/// A file as given from the web or the API: a name and its content.
115		#[derive(Clone, Debug)]
116		pub struct NewFile {
117		pub name: String,
118		pub content: String,
119		}
120
121		/// A file name: a path of plain parts, at most 255 bytes.
122	19×	pub fn check_name(name: &str) -> Result<String, String> {
123	19×	let name = name.trim().trim_matches('/');
124	19×	if name.is_empty() {
125	0×	return Err("Every file needs a name.".into());
126	19×	}
127	19×	if name.len() > 255 {
128	0×	return Err(format!("{name:.40}…: a file name is at most 255 bytes."));
129	19×	}
130	133×	if name.chars().any(\|c\| c.is_control() \|\| c == '\\')
131	19×	\|\| name.split('/').any(\|p\| p.is_empty() \|\| p == "." \|\| p == ".." \|\| p == oxy_core::repo::OXY_DIR \|\| p.trim() != p)
132		{
133	0×	return Err(format!("{name:?} is not a file name: use letters, digits and punctuation, with / between folders."));
134	19×	}
135	19×	Ok(name.to_string())
136	19×	}
137
138		/// Files from the web or the API, checked: named, not too many or too
139		/// large, no name twice, and nothing push protection refuses.
140	9×	pub fn check_files(files: &[NewFile], allow_empty: bool) -> Result<Vec<NewFile>, String> {
141	9×	if files.is_empty() && !allow_empty {
142	0×	return Err("A drop needs at least one file.".into());
143	9×	}
144	9×	if files.len() > MAX_FILES {
145	0×	return Err(format!("A drop takes at most {MAX_FILES} files at a time."));
146	9×	}
147	9×	let mut out: Vec<NewFile> = Vec::with_capacity(files.len());
148	14×	for f in files {
149	14×	let name = check_name(&f.name)?;
150	14×	if f.content.len() > MAX_FILE_BYTES {
151	0×	return Err(format!("{name} is larger than {} KiB; push larger files with oxy.", MAX_FILE_BYTES / 1024));
152	14×	}
153	14×	if out.iter().any(\|o\| o.name == name) {
154	0×	return Err(format!("{name} is named twice."));
155	14×	}
156		// Line endings as the browser's editor shows them.
157	14×	out.push(NewFile { name, content: f.content.replace("\r\n", "\n") });
158		}
159	9×	scan(&out)?;
160	8×	Ok(out)
161	9×	}
162
163		/// Push protection (#268) over what the hub is asked to commit: the same
164		/// rules a push gets, so a drop made on the web cannot carry what a push
165		/// would be refused for.
166	12×	pub fn scan(files: &[NewFile]) -> Result<(), String> {
167	12×	let rules = crate::push_protection::rules();
168	12×	let mut found = Vec::new();
169	17×	for f in files {
170	17×	for h in crate::push_protection::scan_text(rules, f.content.as_bytes()) {
171	2×	let rule = &rules.rules[h.rule];
172	2×	found.push(format!("{}:{}: {} (fingerprint {})", f.name, h.line, rule.description, h.fingerprint));
173	2×	}
174		}
175	12×	if found.is_empty() {
176	10×	return Ok(());
177	2×	}
178	2×	Err(format!(
179		"Push protection refused this: {} like {}, and nothing was saved. {} Take {} out (read credentials from the environment or a secret store), and if {} real, revoke or rotate {}.",
180	2×	if found.len() == 1 { "a value looks".to_string() } else { format!("{} values look", found.len()) },
181	2×	if found.len() == 1 { "a secret" } else { "secrets" },
182	2×	found.join("; "),
183	2×	if found.len() == 1 { "it" } else { "them" },
184	2×	if found.len() == 1 { "it is" } else { "one is" },
185	2×	if found.len() == 1 { "it" } else { "it as well" },
186		))
187	12×	}
188
189	10×	fn check_text(title: &str, description: &str) -> Result<(), String> {
190	10×	if title.chars().count() > MAX_TITLE {
191	0×	return Err(format!("A title is at most {MAX_TITLE} characters."));
192	10×	}
193	10×	if description.chars().count() > MAX_DESCRIPTION {
194	0×	return Err(format!("A description is at most {MAX_DESCRIPTION} characters."));
195	10×	}
196	10×	Ok(())
197	10×	}
198
199		/// The owner's signer: their identity that delegates to the hub's key.
200	9×	async fn signer(app: &Shared, account: &Account) -> Result<Signer, DropError> {
201	9×	crate::web::edit::signer_for(app, account.id).await.map_err(DropError::Bad)
202	9×	}
203
204		/// Make a drop for `account`: a new repository with the files as its first
205		/// change on `main`, authored by the account's identity and signed by the
206		/// hub as its delegate. Nothing is left behind when that fails.
207	7×	pub async fn create(
208	7×	app: &Shared,
209	7×	account: &Account,
210	7×	title: &str,
211	7×	description: &str,
212	7×	secret: bool,
213	7×	files: &[NewFile],
214	7×	) -> Result<RepoRow, DropError> {
215	7×	if account.blocked() {
216	0×	return Err(bad("This account cannot make drops."));
217	7×	}
218	7×	let (title, description) = (title.trim(), description.trim());
219	7×	check_text(title, description).map_err(DropError::Bad)?;
220	7×	let files = check_files(files, false).map_err(DropError::Bad)?;
221	7×	let signer = signer(app, account).await?;
222		// Ids are unique across the hub, so `oh drop view ID` needs no owner.
223	6×	let mut found = None;
224	6×	for _ in 0..8 {
225	6×	let id = crate::auth::random_hex(12);
226	6×	let Some(name) = RepoName::drop(&account.username, &id) else { break };
227	6×	if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
228	6×	found = Some(name);
229	6×	break;
230	0×	}
231		}
232	6×	let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
233	6×	let mut repo_id = [0u8; 16];
234	6×	rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut repo_id);
235	6×	app.repos.create_async(&name, Some(repo_id)).await?;
236	6×	let id = name.drop_id().unwrap_or_default().to_string();
237	6×	let row = match db::repos::create_drop(&app.db, &account.username, &id, title, description, visibility(secret)).await {
238	6×	Ok(row) => row,
239	0×	Err(e) => {
240	0×	let _ = std::fs::remove_dir_all(app.repos.dir(&name));
241	0×	return Err(e.into());
242		}
243		};
244	6×	let edits: Vec<FileEdit> =
245	8×	files.iter().map(\|f\| FileEdit { path: f.name.clone(), content: Some(f.content.clone().into_bytes()) }).collect();
246	6×	let message = if title.is_empty() { "Create the drop".to_string() } else { format!("Create {title}") };
247	6×	let b = row.default_bookmark.clone();
248	6×	match edits::commit(&app.repos, &name, b.clone(), b, edits, message, signer).await {
249	6×	Ok(done) => {
250	6×	recorded(app, account, &row, &done, "drop.created", visibility_label(&row)).await;
251	6×	Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
252		}
253	0×	Err(e) => {
254	0×	db::repos::delete(&app.db, row.id).await.ok();
255	0×	let _ = std::fs::remove_dir_all(app.repos.dir(&name));
256	0×	Err(DropError::Bad(format!("The drop was not made: {e}")))
257		}
258		}
259	7×	}
260
261		/// Fork `source` for `account` (#280): a new drop of theirs whose history
262		/// starts from it (its objects linked, its bookmarks copied), with its
263		/// title, description and secrecy, noting where it came from.
264	2×	pub async fn fork(app: &Shared, account: &Account, source: &RepoRow) -> Result<RepoRow, DropError> {
265	2×	if account.blocked() {
266	0×	return Err(bad("This account cannot make drops."));
267	2×	}
268	2×	let Some(from) = RepoName::new(&source.owner, &source.name) else { return Err(bad("That is not a drop.")) };
269	2×	let mut found = None;
270	2×	for _ in 0..8 {
271	2×	let id = crate::auth::random_hex(12);
272	2×	let Some(name) = RepoName::drop(&account.username, &id) else { break };
273	2×	if db::repos::drop_by_id(&app.db, &id).await?.is_none() && !app.repos.exists(&name) {
274	2×	found = Some(name);
275	2×	break;
276	0×	}
277		}
278	2×	let Some(name) = found else { return Err(bad("No free drop id was found; try again.")) };
279	2×	app.repos.fork(&from, &name).await?;
280	2×	let id = name.drop_id().unwrap_or_default().to_string();
281	2×	let row = match db::repos::create_drop(&app.db, &account.username, &id, &source.title, &source.description, source.visibility()).await {
282	2×	Ok(row) => row,
283	0×	Err(e) => {
284	0×	let _ = std::fs::remove_dir_all(app.repos.dir(&name));
285	0×	return Err(e.into());
286		}
287		};
288	2×	db::repos::set_forked_from(&app.db, row.id, source.id).await?;
289	2×	db::accounts::audit(&app.db, Some(account), "drop.forked", &url_of(&row), &url_of(source)).await.ok();
290	2×	Ok(db::repos::get_by_id(&app.db, row.id).await?.unwrap_or(row))
291	2×	}
292
293		/// The longest comment on a drop, in bytes.
294		pub const COMMENT_MAX: usize = 64 * 1024;
295
296		/// `account` comments on `row` (#280, oxygenhub#349): some Markdown, at most
297		/// [`COMMENT_MAX`]; the drop's owner is told. The comment's number.
298	5×	pub async fn add_comment(app: &Shared, account: &Account, row: &RepoRow, body: &str) -> Result<i64, DropError> {
299	5×	let body = body.trim();
300	5×	if body.is_empty() \|\| body.len() > COMMENT_MAX \|\| account.blocked() {
301	1×	return Err(bad("A comment is some text, at most 64 KiB."));
302	4×	}
303	4×	let n = db::repos::add_drop_comment(&app.db, row.id, account.id, &account.username, body).await?;
304	4×	if account.username != row.owner {
305	3×	if let Ok(Some(owner)) = db::accounts::account_by_name(&app.db, &row.owner).await {
306	3×	let title = format!("{} on your drop {}", account.username, shown_title(row, &[]));
307	3×	crate::notify::tell(
308	3×	app,
309	3×	"drop.comment",
310	3×	&title,
311	3×	&format!("{}#comment-{n}", url_of(row)),
312	3×	&account.username,
313	3×	Some(row.id),
314	3×	vec![(owner.id, db::notify::Reason::Participating)],
315	3×	)
316	3×	.await;
317	0×	}
318	1×	}
319	4×	Ok(n)
320	5×	}
321
322		/// Whether `account` may delete comment `c` on `row`: its author, the
323		/// drop's owner or a site administrator.
324	13×	pub fn may_delete_comment(account: Option<&Account>, row: &RepoRow, c: &db::repos::DropComment) -> bool {
325	13×	account.is_some_and(\|a\| !a.blocked() && (Some(a.id) == c.author_id \|\| a.username == row.owner \|\| a.is_admin))
326	13×	}
327
328		/// What a change to a drop's text or files is.
329		pub struct Update {
330		pub title: String,
331		pub description: String,
332		pub secret: bool,
333		/// Files to write or (content `None`) remove; others are kept.
334		pub files: Vec<FileEdit>,
335		pub message: String,
336		}
337
338		/// Change a drop: its files in one change made as the owner's delegate,
339		/// when any changed, and its title, description and visibility.
340	3×	pub async fn update(app: &Shared, account: &Account, row: &RepoRow, u: Update) -> Result<(), DropError> {
341	3×	let (title, description) = (u.title.trim(), u.description.trim());
342	3×	check_text(title, description).map_err(DropError::Bad)?;
343	3×	if !u.files.is_empty() {
344	3×	if u.files.len() > MAX_FILES {
345	0×	return Err(bad(format!("A drop takes at most {MAX_FILES} files at a time.")));
346	3×	}
347	3×	let written: Vec<NewFile> = u
348	3×	.files
349	3×	.iter()
350	3×	.filter_map(\|e\| e.content.as_ref().map(\|c\| NewFile { name: e.path.clone(), content: String::from_utf8_lossy(c).into_owned() }))
351	3×	.collect();
352	3×	for f in &written {
353	3×	check_name(&f.name).map_err(DropError::Bad)?;
354	3×	if f.content.len() > MAX_FILE_BYTES {
355	0×	return Err(bad(format!("{} is larger than {} KiB; push larger files with oxy.", f.name, MAX_FILE_BYTES / 1024)));
356	3×	}
357		}
358	3×	scan(&written).map_err(DropError::Bad)?;
359	2×	let signer = signer(app, account).await?;
360	2×	let name = RepoName::new(&row.owner, &row.name).ok_or_else(\|\| bad("not a drop"))?;
361	2×	let message = if u.message.trim().is_empty() {
362	1×	format!("Edit {}", if title.is_empty() { id_of(row) } else { title })
363		} else {
364	1×	u.message.trim().to_string()
365		};
366		// Removing every file would leave an empty drop: delete it instead.
367	2×	if u.files.iter().any(\|e\| e.content.is_none()) {
368	0×	let (_, current) = files(app, row, "").await?;
369	0×	let left = current.iter().filter(\|c\| !u.files.iter().any(\|e\| e.path == c.path && e.content.is_none())).count();
370	0×	if left == 0 && written.is_empty() {
371	0×	return Err(bad("A drop keeps at least one file; delete the drop instead."));
372	0×	}
373	2×	}
374	2×	let b = row.default_bookmark.clone();
375	2×	let done = edits::commit(&app.repos, &name, b.clone(), b, u.files, message, signer)
376	2×	.await
377	2×	.map_err(\|e\| DropError::Bad(format!("The drop was not changed: {e}")))?;
378	2×	recorded(app, account, row, &done, "drop.edited", "").await;
379	0×	}
380	2×	db::repos::set_drop(&app.db, row.id, title, description, visibility(u.secret)).await?;
381	2×	if visibility(u.secret) != row.visibility() {
382	1×	db::accounts::audit(&app.db, Some(account), "drop.visibility", &row.slug(), if u.secret { "secret" } else { "public" }).await.ok();
383	1×	}
384	2×	Ok(())
385	3×	}
386
387		/// The push log and the audit log for a change the hub made to a drop.
388	8×	async fn recorded(app: &Shared, account: &Account, row: &RepoRow, done: &edits::Committed, action: &str, detail: &str) {
389	8×	let outcome = db::repos::PushOutcome {
390	8×	reference: done.bookmark.clone(),
391	8×	ok: true,
392	8×	reason: "web edit".into(),
393	8×	old_state: done.old_state.clone(),
394	8×	new_state: done.new_state.clone(),
395	8×	heads: done.heads.len() as i64,
396	8×	changes: 1,
397	8×	};
398	8×	db::repos::record_push(&app.db, row.id, Some((account.id, &account.username)), &[outcome]).await.ok();
399	8×	let detail = if detail.is_empty() { done.change.short(12) } else { format!("{detail} {}", done.change.short(12)) };
400	8×	db::accounts::audit(&app.db, Some(account), action, &row.slug(), &detail).await.ok();
401	8×	}
402
403		/// Delete a drop: its directory to the trash and its row, once nothing
404		/// reads or writes it (#249), audited.
405	4×	pub async fn delete(app: &Shared, actor: &Account, row: &RepoRow) -> Result<(), DropError> {
406	4×	let name = RepoName::new(&row.owner, &row.name).ok_or_else(\|\| bad("not a drop"))?;
407	4×	let _guard = app.repos.exclusive_guard(&name).await;
408	4×	match app.repos.trash(&name) {
409	4×	Ok(_) \| Err(RepoError::NotFound) => {}
410	0×	Err(e) => return Err(e.into()),
411		}
412	4×	db::repos::delete(&app.db, row.id).await?;
413	4×	db::accounts::audit(&app.db, Some(actor), "drop.deleted", &row.slug(), "moved to trash").await.ok();
414	4×	Ok(())
415	4×	}
416
417		/// The drop's files at `spec` (its default bookmark when empty): every
418		/// file, with its text when it is text and small enough to show.
419	53×	pub async fn files(app: &Shared, row: &RepoRow, spec: &str) -> Result<(crate::repos::view::RefTarget, Vec<DropFile>), RepoError> {
420	53×	let name = RepoName::new(&row.owner, &row.name).ok_or(RepoError::NotFound)?;
421	53×	let spec = if spec.is_empty() { row.default_bookmark.clone() } else { spec.to_string() };
422	53×	app.repos
423	53×	.read(&name, move \|repo, cache\| {
424	53×	let target = crate::repos::view::resolve(repo, cache, &spec)?;
425	53×	let loaded = cache.load(repo, &target.heads)?;
426	53×	let mut out = Vec::new();
427	80×	for (path, f) in &loaded.snapshot.files {
428	80×	let bytes = match (&f.kind, &f.content) {
429	0×	(NodeKind::Dir, _) \| (_, FileContent::Dir) => continue,
430	80×	(_, FileContent::Text { bytes, .. }) => bytes.clone(),
431	0×	(_, FileContent::Opaque { blobs }) => match blobs.first() {
432	0×	Some(b) => repo.read_blob(b)?,
433	0×	None => Vec::new(),
434		},
435		};
436	80×	let size = bytes.len() as u64;
437	80×	let text = if size <= SHOWN_BYTES && !crate::repos::view::is_binary(&bytes) { String::from_utf8(bytes).ok() } else { None };
438	80×	out.push(DropFile { path: path.clone(), size, text });
439		}
440	53×	Ok((target, out))
441	53×	})
442	53×	.await
443	53×	}
444
445		/// The drop `id` of `owner`, or none.
446	56×	pub async fn find(app: &Shared, owner: &str, id: &str) -> sqlx::Result<Option<RepoRow>> {
447	56×	let Some(name) = RepoName::drop(owner, id) else { return Ok(None) };
448	56×	Ok(db::repos::get(&app.db, &name.owner, &name.name).await?.filter(\|r\| r.is_drop()))
449	56×	}
450
451		/// Whether `account` may change the drop: its owner alone.
452	78×	pub fn may_edit(account: Option<&Account>, row: &RepoRow) -> bool {
453	78×	account.is_some_and(\|a\| !a.blocked() && a.username.eq_ignore_ascii_case(&row.owner))
454	78×	}
455
456		/// Whether `account` may delete the drop: its owner, or a site
457		/// administrator.
458	40×	pub fn may_delete(account: Option<&Account>, row: &RepoRow) -> bool {
459	40×	may_edit(account, row) \|\| account.is_some_and(\|a\| !a.blocked() && a.is_admin)
460	40×	}
461
462		/// Whether the drop is listed to `account`: public ones to everyone, secret
463		/// ones to their owner and site administrators only.
464	14×	pub fn listed_to(account: Option<&Account>, row: &RepoRow) -> bool {
465	14×	row.visibility() == Visibility::Public \|\| may_delete(account, row)
466	14×	}
467
468		/// The edits that turn `current` text files into `wanted`: files gone are
469		/// removed, new or changed ones written. Files that are not text (pushed
470		/// with oxy) are left alone.
471	1×	pub fn edits_between(current: &[DropFile], wanted: &[NewFile]) -> Vec<FileEdit> {
472	1×	let mut out = Vec::new();
473	2×	for c in current.iter().filter(\|c\| c.text.is_some()) {
474	3×	if !wanted.iter().any(\|w\| w.name == c.path) {
475	0×	out.push(FileEdit { path: c.path.clone(), content: None });
476	2×	}
477		}
478	2×	for w in wanted {
479	3×	let same = current.iter().any(\|c\| c.path == w.name && c.text.as_deref() == Some(w.content.as_str()));
480	2×	if !same {
481	1×	out.push(FileEdit { path: w.name.clone(), content: Some(w.content.clone().into_bytes()) });
482	1×	}
483		}
484	1×	out
485	1×	}

Coverage / crates/hub/src/drops.rs 83.7%

Keyboard