415 lines
9.1 KiB
Go
415 lines
9.1 KiB
Go
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
package state
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
|
|
"simplegit/common"
|
|
)
|
|
|
|
|
|
|
|
|
|
func parseRepoPath(path string) (ns, name string, err error) {
|
|
path = strings.TrimPrefix(path, "/")
|
|
path = strings.TrimSuffix(path, ".git")
|
|
if i := strings.LastIndex(path, "/"); i >= 0 {
|
|
return path[:i], path[i+1:], nil
|
|
}
|
|
return "", "", fmt.Errorf("repo path %q has no namespace segment", path)
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) nsDir(ns string) (string, error) {
|
|
ns = strings.TrimPrefix(ns, "/")
|
|
if ns == "" || strings.Contains(ns, "..") {
|
|
return "", fmt.Errorf("invalid namespace %q", ns)
|
|
}
|
|
abs, err := filepath.Abs(filepath.Join(s.cfg.RepoRoot(), ns))
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
rootAbs, err := filepath.Abs(s.cfg.RepoRoot())
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
if abs == rootAbs || !strings.HasPrefix(abs, rootAbs+string(os.PathSeparator)) {
|
|
return "", fmt.Errorf("namespace path escapes root")
|
|
}
|
|
return abs, nil
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) resolveNamespaceID(ns string) (int64, error) {
|
|
var r Repo
|
|
has, err := s.engine.Where("namespace = ?", ns).Get(&r)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("lookup namespace: %w", err)
|
|
}
|
|
if !has {
|
|
return 0, fmt.Errorf("namespace %q: %w", ns, ErrNamespaceNotFound)
|
|
}
|
|
return r.NamespaceID, nil
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) nextNameID() (int64, error) {
|
|
var row struct {
|
|
M int64 `xorm:"m"`
|
|
}
|
|
if _, err := s.engine.SQL("SELECT COALESCE(MAX(name_id), 0) AS m FROM repo").Get(&row); err != nil {
|
|
return 0, fmt.Errorf("next name id: %w", err)
|
|
}
|
|
return row.M + 1, nil
|
|
}
|
|
|
|
|
|
|
|
func (s *LocalState) nextNamespaceID() (int64, error) {
|
|
var row struct {
|
|
M int64 `xorm:"m"`
|
|
}
|
|
if _, err := s.engine.SQL("SELECT COALESCE(MAX(namespace_id), 0) AS m FROM repo").Get(&row); err != nil {
|
|
return 0, fmt.Errorf("next namespace id: %w", err)
|
|
}
|
|
return row.M + 1, nil
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) CreateRepo(ns, name string) error {
|
|
path, err := s.cfg.RepoPath(ns, name)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if _, err := os.Stat(path); err == nil {
|
|
return fmt.Errorf("create repo: already exists on disk: %s", path)
|
|
}
|
|
|
|
var nsID, nameID int64
|
|
nsID, err = s.resolveNamespaceID(ns)
|
|
if err != nil {
|
|
if !errors.Is(err, ErrNamespaceNotFound) {
|
|
return err
|
|
}
|
|
nsID, err = s.nextNamespaceID()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
nameID, err = s.nextNameID()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
|
|
return fmt.Errorf("create repo: mkdir ns: %w", err)
|
|
}
|
|
|
|
|
|
|
|
|
|
initArgs := []string{"init", "--bare"}
|
|
if fi, err := os.Stat(s.cfg.TemplateDir()); err == nil && fi.IsDir() {
|
|
initArgs = append(initArgs, "--template="+s.cfg.TemplateDir())
|
|
}
|
|
initArgs = append(initArgs, path)
|
|
if out, err := exec.Command("git", initArgs...).CombinedOutput(); err != nil {
|
|
return fmt.Errorf("create repo: git init: %w: %s", err, strings.TrimSpace(string(out)))
|
|
}
|
|
|
|
if _, err := s.engine.Insert(&Repo{
|
|
NamespaceID: nsID,
|
|
Namespace: ns,
|
|
NameID: nameID,
|
|
Name: name,
|
|
}); err != nil {
|
|
_ = os.RemoveAll(path)
|
|
return fmt.Errorf("create repo: insert: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
|
|
func (s *LocalState) ExistRepo(ns, name string) error {
|
|
_, err := s.findRepo(ns, name)
|
|
return err
|
|
}
|
|
|
|
|
|
|
|
func (s *LocalState) DeleteRepo(ns, name string) error {
|
|
path, _ := s.cfg.RepoPath(ns, name)
|
|
r, err := s.findRepo(ns, name)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if _, err := s.engine.Where("target_type = ? AND target_id = ?", TargetTypeRepo, r.ID).Unscoped().Delete(&ACL{}); err != nil {
|
|
return fmt.Errorf("delete repo acls: %w", err)
|
|
}
|
|
if _, err := s.engine.ID(r.ID).Unscoped().Delete(&Repo{}); err != nil {
|
|
return fmt.Errorf("delete repo: %w", err)
|
|
}
|
|
if path != "" {
|
|
_ = os.RemoveAll(path)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) MoveRepo(old, new string) error {
|
|
oldNs, oldName, err := parseRepoPath(old)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
newNs, newName, err := parseRepoPath(new)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
oldPath, err := s.cfg.RepoPath(oldNs, oldName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
newPath, err := s.cfg.RepoPath(newNs, newName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if _, err := os.Stat(newPath); err == nil {
|
|
return fmt.Errorf("move repo: destination exists: %s", newPath)
|
|
}
|
|
if err := os.MkdirAll(filepath.Dir(newPath), 0o755); err != nil {
|
|
return fmt.Errorf("move repo: mkdir ns: %w", err)
|
|
}
|
|
if err := os.Rename(oldPath, newPath); err != nil {
|
|
return fmt.Errorf("move repo: rename: %w", err)
|
|
}
|
|
r, err := s.findRepo(oldNs, oldName)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
upd := Repo{Namespace: newNs, Name: strings.TrimSuffix(newName, ".git")}
|
|
cols := []string{"namespace", "name"}
|
|
if newNs != oldNs {
|
|
nsID, err := s.resolveNamespaceID(newNs)
|
|
if err != nil {
|
|
_ = os.Rename(newPath, oldPath)
|
|
return err
|
|
}
|
|
upd.NamespaceID = nsID
|
|
cols = append(cols, "namespace_id")
|
|
}
|
|
if _, err := s.engine.ID(r.ID).Cols(cols...).Update(&upd); err != nil {
|
|
_ = os.Rename(newPath, oldPath)
|
|
return fmt.Errorf("move repo: update: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) MoveNS(old, new string) error {
|
|
if old == new {
|
|
return nil
|
|
}
|
|
oldDir, err := s.nsDir(old)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
newDir, err := s.nsDir(new)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if _, err := os.Stat(newDir); err == nil {
|
|
return fmt.Errorf("move ns: destination exists: %s", newDir)
|
|
}
|
|
if err := os.Rename(oldDir, newDir); err != nil {
|
|
return fmt.Errorf("move ns: rename: %w", err)
|
|
}
|
|
if _, err := s.engine.Where("namespace = ?", old).Cols("namespace").Update(&Repo{Namespace: new}); err != nil {
|
|
_ = os.Rename(newDir, oldDir)
|
|
return fmt.Errorf("move ns: update: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) upsertACL(credType CredType, credID int64, targetType TargetType, targetID int64, perm common.Perm) (int64, error) {
|
|
var acl ACL
|
|
has, err := s.engine.Where("cred_type = ? AND cred_id = ? AND target_type = ? AND target_id = ?",
|
|
credType, credID, targetType, targetID).Get(&acl)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("lookup acl: %w", err)
|
|
}
|
|
if has {
|
|
if acl.Perm != string(perm) {
|
|
if _, err := s.engine.ID(acl.ID).Cols("perm").Update(&ACL{Perm: string(perm)}); err != nil {
|
|
return 0, fmt.Errorf("update acl: %w", err)
|
|
}
|
|
}
|
|
return acl.ID, nil
|
|
}
|
|
acl = ACL{
|
|
CredType: int(credType),
|
|
CredID: credID,
|
|
TargetType: int(targetType),
|
|
TargetID: targetID,
|
|
Perm: string(perm),
|
|
}
|
|
if _, err := s.engine.Insert(&acl); err != nil {
|
|
return 0, fmt.Errorf("insert acl: %w", err)
|
|
}
|
|
return acl.ID, nil
|
|
}
|
|
|
|
|
|
func (s *LocalState) ACLDelete(id int64) error {
|
|
if _, err := s.engine.ID(id).Unscoped().Delete(&ACL{}); err != nil {
|
|
return fmt.Errorf("delete acl: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
|
|
func (s *LocalState) ensureSSHKey(key ssh.PublicKey) (int64, error) {
|
|
fp := fingerprint(key)
|
|
var sk SSHKey
|
|
has, err := s.engine.Where("fingerprint = ?", fp).Get(&sk)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("lookup ssh key: %w", err)
|
|
}
|
|
if has {
|
|
return sk.ID, nil
|
|
}
|
|
sk = SSHKey{
|
|
PublicKey: string(key.Marshal()),
|
|
Fingerprint: fp,
|
|
KeyType: key.Type(),
|
|
}
|
|
if _, err := s.engine.Insert(&sk); err != nil {
|
|
return 0, fmt.Errorf("insert ssh key: %w", err)
|
|
}
|
|
return sk.ID, nil
|
|
}
|
|
|
|
|
|
|
|
|
|
func (s *LocalState) ensurePAT(plaintext string) (int64, error) {
|
|
sum := sha256.Sum256([]byte(plaintext))
|
|
hash := hex.EncodeToString(sum[:])
|
|
var pat PAT
|
|
has, err := s.engine.Where("token_hash = ?", hash).Get(&pat)
|
|
if err != nil {
|
|
return 0, fmt.Errorf("lookup pat: %w", err)
|
|
}
|
|
if has {
|
|
return pat.ID, nil
|
|
}
|
|
prefix := plaintext
|
|
if n := len(patPrefix) + 8; len(prefix) > n {
|
|
prefix = prefix[:n]
|
|
}
|
|
pat = PAT{TokenHash: hash, Prefix: prefix}
|
|
if _, err := s.engine.Insert(&pat); err != nil {
|
|
return 0, fmt.Errorf("insert pat: %w", err)
|
|
}
|
|
return pat.ID, nil
|
|
}
|
|
|
|
|
|
|
|
func (s *LocalState) ACLUpsertSSHKeyOnNS(ns string, key ssh.PublicKey, perm common.Perm) (int64, error) {
|
|
nsID, err := s.resolveNamespaceID(ns)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
keyID, err := s.ensureSSHKey(key)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return s.upsertACL(CredTypeSSH, keyID, TargetTypeNS, nsID, perm)
|
|
}
|
|
|
|
|
|
|
|
func (s *LocalState) ACLUpsertPATOnNS(ns string, pat string, perm common.Perm) (int64, error) {
|
|
nsID, err := s.resolveNamespaceID(ns)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
patID, err := s.ensurePAT(pat)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return s.upsertACL(CredTypePAT, patID, TargetTypeNS, nsID, perm)
|
|
}
|
|
|
|
|
|
func (s *LocalState) ACLUpsertSSHKeyOnRepo(reponame string, key ssh.PublicKey, perm common.Perm) (int64, error) {
|
|
ns, name, err := parseRepoPath(reponame)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
r, err := s.findRepo(ns, name)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
keyID, err := s.ensureSSHKey(key)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return s.upsertACL(CredTypeSSH, keyID, TargetTypeRepo, r.ID, perm)
|
|
}
|
|
|
|
|
|
|
|
func (s *LocalState) ACLUpsertPATOnRepo(reponame string, pat string, perm common.Perm) (int64, error) {
|
|
ns, name, err := parseRepoPath(reponame)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
r, err := s.findRepo(ns, name)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
patID, err := s.ensurePAT(pat)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
return s.upsertACL(CredTypePAT, patID, TargetTypeRepo, r.ID, perm)
|
|
}
|