solpbc.org
cloudflare-native port of the tangled knot server
1package xrpc
2
3import (
4 "context"
5 "encoding/json"
6 "errors"
7 "fmt"
8 "net/http"
9
10 "github.com/bluesky-social/indigo/api/atproto"
11 "github.com/bluesky-social/indigo/atproto/syntax"
12 "github.com/bluesky-social/indigo/xrpc"
13
14 "tangled.org/core/api/tangled"
15 "tangled.org/core/rbac"
16 xrpcerr "tangled.org/core/xrpc/errors"
17)
18
19func (x *Xrpc) TriggerPipeline(w http.ResponseWriter, r *http.Request) {
20 l := x.Logger
21 fail := func(e xrpcerr.XrpcError) {
22 l.Error("failed", "kind", e.Tag, "error", e.Message)
23 writeError(w, e, http.StatusBadRequest)
24 }
25 l.Debug("trigger pipeline")
26
27 actorDid, ok := r.Context().Value(ActorDid).(syntax.DID)
28 if !ok {
29 fail(xrpcerr.MissingActorDidError)
30 return
31 }
32
33 var input tangled.CiPipelineTriggerPipeline_Input
34 if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
35 fail(xrpcerr.GenericError(err))
36 return
37 }
38
39 if len(input.Sha) != 40 {
40 fail(xrpcerr.GenericError(fmt.Errorf("sha must be a 40-character commit hash")))
41 return
42 }
43
44 repoDid, xerr, ok := x.resolveOwnedRepo(r.Context(), actorDid, input.Repo)
45 if !ok {
46 fail(xerr)
47 return
48 }
49
50 ref := ""
51 if input.Ref != nil {
52 ref = *input.Ref
53 }
54
55 pipelineAt, err := x.Trigger.TriggerManual(r.Context(), repoDid, input.Sha, ref, input.Workflows)
56 if errors.Is(err, ErrNoMatchingWorkflows) {
57 fail(xrpcerr.GenericError(err))
58 return
59 }
60 if err != nil {
61 fail(xrpcerr.GenericError(fmt.Errorf("failed to trigger pipeline: %w", err)))
62 return
63 }
64
65 if err := writeJson(w, http.StatusOK, tangled.CiPipelineTriggerPipeline_Output{
66 Pipeline: pipelineAt.String(),
67 }); err != nil {
68 l.Error("failed to write response", "err", err)
69 }
70}
71
72// resolveOwnedRepo resolves a repo AT-URI to DID and checks owner auth
73func (x *Xrpc) resolveOwnedRepo(ctx context.Context, actorDid syntax.DID, repoAtUri string) (syntax.DID, xrpcerr.XrpcError, bool) {
74 repoAt, err := syntax.ParseATURI(repoAtUri)
75 if err != nil {
76 return "", xrpcerr.InvalidRepoError(repoAtUri), false
77 }
78
79 ident, err := x.Resolver.ResolveIdent(ctx, repoAt.Authority().String())
80 if err != nil || ident.Handle.IsInvalidHandle() {
81 return "", xrpcerr.GenericError(fmt.Errorf("failed to resolve handle: %w", err)), false
82 }
83
84 xrpcc := xrpc.Client{Host: ident.PDSEndpoint()}
85 resp, err := atproto.RepoGetRecord(ctx, &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String())
86 if err != nil {
87 return "", xrpcerr.GenericError(err), false
88 }
89
90 repoRec, ok := resp.Value.Val.(*tangled.Repo)
91 if !ok {
92 return "", xrpcerr.RepoNotFoundError, false
93 }
94 if repoRec.RepoDid == nil || *repoRec.RepoDid == "" {
95 return "", xrpcerr.GenericError(fmt.Errorf("repo record %s has no repoDid", repoAt)), false
96 }
97 repoDid := *repoRec.RepoDid
98
99 isPushAllowed, err := x.Enforcer.IsPushAllowed(actorDid.String(), rbac.ThisServer, repoDid)
100 if err != nil || !isPushAllowed {
101 return "", xrpcerr.AccessControlError(actorDid.String()), false
102 }
103
104 return syntax.DID(repoDid), xrpcerr.XrpcError{}, true
105}