internal/store/lfs.go

 1package store
 2
 3import (
 4	"database/sql"
 5	"errors"
 6)
 7
 8// LFSSecret returns the instance's LFS token-signing secret, minting and
 9// persisting one on first use. gen supplies the new value so this package
10// stays free of crypto choices.
11func (s *Store) LFSSecret(gen func() string) (string, error) {
12	var v string
13	err := s.DB.QueryRow("SELECT value FROM settings WHERE key = 'lfs_secret'").Scan(&v)
14	if err == nil {
15		return v, nil
16	}
17	if !errors.Is(err, sql.ErrNoRows) {
18		return "", err
19	}
20	v = gen()
21	// A concurrent first use may win the insert; read back the winner.
22	if _, err := s.DB.Exec(
23		"INSERT INTO settings (key, value) VALUES ('lfs_secret', ?) ON CONFLICT (key) DO NOTHING", v); err != nil {
24		return "", err
25	}
26	err = s.DB.QueryRow("SELECT value FROM settings WHERE key = 'lfs_secret'").Scan(&v)
27	return v, err
28}