internal/control/identity.go

  1package control
  2
  3import (
  4	"errors"
  5	"fmt"
  6	"io"
  7	"strings"
  8	"time"
  9	"unicode"
 10
 11	"golang.org/x/crypto/ssh"
 12
 13	"gitbay.org/gitbay/internal/protocol"
 14	"gitbay.org/gitbay/internal/store"
 15)
 16
 17func init() {
 18	register(Command{
 19		Path:     []string{"whoami"},
 20		Summary:  "show the authenticated account",
 21		Usage:    "whoami",
 22		Examples: []string{"whoami"},
 23		ReadOnly: true,
 24		Run:      runWhoami,
 25	})
 26	register(Command{
 27		Path:     []string{"keys", "list"},
 28		Summary:  "list registered SSH keys",
 29		Usage:    "keys list",
 30		Examples: []string{"keys list"},
 31		ReadOnly: true,
 32		Run:      runKeysList,
 33	})
 34	register(Command{
 35		Path:    []string{"keys", "add"},
 36		Summary: "register an SSH public key (authorized_keys format)",
 37		Usage:   "keys add [--scope full|git|runner] [--label <text>] [--ttl 30d|720h] < key.pub",
 38		Flags: []Flag{
 39			{"--scope", "full|git|runner", "what the key may do", "full"},
 40			{"--label", "<text>", "a name for the key", ""},
 41			{"--ttl", "30d|720h", "how long the key authenticates; an expiring key cannot mint credentials", "never expires"},
 42		},
 43		Examples:        []string{"keys add --label laptop < key.pub", "keys add --scope git --ttl 90d < ci.pub"},
 44		ReadsStdin:      true,
 45		MintsCredential: true, NeedsRecentSignIn: true,
 46		Run: runKeysAdd,
 47	})
 48	register(Command{
 49		Path:     []string{"keys", "label"},
 50		Summary:  "name a key; an empty label clears it",
 51		Usage:    "keys label <fingerprint> [<text>]",
 52		Examples: []string{`keys label SHA256:abcd1234 "work laptop"`},
 53		Run:      runKeysLabel,
 54	})
 55	register(Command{
 56		Path:     []string{"keys", "remove"},
 57		Summary:  "remove an SSH key by fingerprint",
 58		Usage:    "keys remove <fingerprint>",
 59		Examples: []string{"keys remove SHA256:abcd1234"},
 60		Run:      runKeysRemove,
 61	})
 62}
 63
 64func runWhoami(c *Ctx, args []string) int {
 65	if len(args) != 0 {
 66		return c.usage()
 67	}
 68	type out struct {
 69		Username string `json:"username"`
 70		Admin    bool   `json:"admin"`
 71		KeyScope string `json:"key_scope"`
 72	}
 73	d := out{Username: c.User.Username, Admin: c.User.IsAdmin, KeyScope: c.Scope}
 74	return c.emitView(d, func(w io.Writer) {
 75		fmt.Fprintln(w, d.Username)
 76	}, func() screen {
 77		s := screen{fields: []field{{"User", []cell{cText(d.Username)}}}}
 78		if d.Admin {
 79			s.fields = append(s.fields, field{"Role", []cell{cState("admin")}})
 80		}
 81		if c.Cfg.Server.SiteURL != "" {
 82			s.fields = append(s.fields, field{"Instance", []cell{cText(c.Cfg.Server.SiteURL)}})
 83		}
 84		// The key's label, or the start of its fingerprint: keys list
 85		// has the whole of it.
 86		via := c.Source
 87		if k, err := c.Store.SSHKeyByFingerprint(c.Source); err == nil && k.Label != "" {
 88			via = k.Label
 89		} else if len(via) > 20 {
 90			via = via[:19] + "…"
 91		}
 92		if via != "" {
 93			s.fields = append(s.fields, field{"Key", []cell{cText(via)}})
 94		}
 95		if d.KeyScope != "" {
 96			s.fields = append(s.fields, field{"Scope", []cell{cState(d.KeyScope)}})
 97		}
 98		s.actions = []action{
 99			{"Account", []string{"keys", "list"}},
100			{"Account", []string{"token", "list"}},
101			{"Account", []string{"email", "list"}},
102		}
103		return s
104	})
105}
106
107func runKeysList(c *Ctx, args []string) int {
108	if len(args) != 0 {
109		return c.usage()
110	}
111	keys, err := c.Store.ListSSHKeys(c.User.ID)
112	if err != nil {
113		return c.fail(protocol.ExitFailure, "listing keys: %v", err)
114	}
115	type out struct {
116		Fingerprint string     `json:"fingerprint"`
117		Algo        string     `json:"algo"`
118		Scope       string     `json:"scope"`
119		Label       string     `json:"label"`
120		CreatedBy   string     `json:"created_by,omitempty"`
121		LastUsedAt  string     `json:"last_used_at,omitempty"`
122		ExpiresAt   *time.Time `json:"expires_at,omitempty"`
123	}
124	var ds []out
125	for _, k := range keys {
126		ds = append(ds, out{k.Fingerprint, k.Algo, k.Scope, k.Label, k.CreatedBy, k.LastUsedAt, k.ExpiresAt})
127	}
128	now := time.Now()
129	return c.emitView(ds, func(w io.Writer) {
130		tb := c.table(w, "FINGERPRINT", "ALGO", "SCOPE", "LABEL", "USED", "EXPIRES")
131		for _, d := range ds {
132			tb.row(cFlex(d.Fingerprint), cText(d.Algo), cState(d.Scope), cText(d.Label),
133				cText(c.usedText(d.LastUsedAt)), cText(c.expiresText(d.ExpiresAt, now)))
134		}
135		tb.flush()
136	}, func() screen {
137		rows := make([]row, len(ds))
138		for i, d := range ds {
139			lead, used := cGlyph(""), "used "+c.usedText(d.LastUsedAt)
140			if d.Fingerprint == c.Source {
141				lead, used = cYou(), "this session"
142			}
143			rows[i] = rowOf(cFlexRef(d.Fingerprint), lead, cState(d.Scope), cText(d.Label), cMeta(d.Algo, used, c.expiresText(d.ExpiresAt, now)))
144		}
145		return listScreen("SSH keys", rows,
146			action{"Keys", []string{"keys", "label", "<fingerprint>", "<text>"}},
147			action{"Keys", []string{"keys", "remove", "<fingerprint>"}},
148		)
149	})
150}
151
152// maxKeyLabel bounds a key's name. Labels are display text, one line.
153const maxKeyLabel = 64
154
155// keyLabel normalises a label: surrounding space trimmed, control
156// characters refused, length capped. An empty result is a valid "no
157// label".
158func keyLabel(s string) (string, error) {
159	s = strings.TrimSpace(s)
160	if len(s) > maxKeyLabel {
161		return "", fmt.Errorf("label is longer than %d bytes", maxKeyLabel)
162	}
163	for _, r := range s {
164		if unicode.IsControl(r) {
165			return "", errors.New("label must be a single line of printable text")
166		}
167	}
168	return s, nil
169}
170
171// usedText is a key's last use as a USED cell shows it.
172func (c *Ctx) usedText(ts string) string {
173	switch {
174	case ts == "":
175		return "never"
176	case c.Term.Cols == 0:
177		return stamp(ts)
178	}
179	return relAge(ts, termNow())
180}
181
182// expiresText is a credential's expiry as an EXPIRES cell shows it:
183// RFC3339 in plain output, relative at a terminal.
184func (c *Ctx) expiresText(t *time.Time, now time.Time) string {
185	if t == nil {
186		return "never"
187	}
188	s := stamp(t.UTC().Format(time.RFC3339Nano))
189	if c.Term.Cols > 0 {
190		s = relAge(s, now)
191	}
192	if !t.After(now) {
193		return "expired " + s
194	}
195	return s
196}
197
198func runKeysAdd(c *Ctx, args []string) int {
199	f, err := c.parseArgs(args, flagSpec{Values: []string{"--scope", "--label", "--ttl"}, MaxPos: 0, Usage: c.Cmd.Usage})
200	if err != nil {
201		return c.fail(protocol.ExitUsage, "%v", err)
202	}
203	scope := "full"
204	if f.Has("--scope") {
205		scope = f.Value("--scope")
206	}
207	if scope != "full" && scope != "git" && scope != "runner" {
208		// deploy:* scopes are granted via repo settings, not self-service.
209		return c.fail(protocol.ExitUsage, "scope must be full, git or runner")
210	}
211	expires, code := c.ttlFlag(f)
212	if code >= 0 {
213		return code
214	}
215	raw, err := io.ReadAll(io.LimitReader(c.Stdin, 64<<10))
216	if err != nil {
217		return c.fail(protocol.ExitFailure, "reading key: %v", err)
218	}
219	pub, comment, _, _, err := ssh.ParseAuthorizedKey(raw)
220	if err != nil {
221		return c.fail(protocol.ExitUsage, "not a valid public key in authorized_keys format: %v", err)
222	}
223	// The key's own comment is the label unless --label says otherwise.
224	label := comment
225	if f.Has("--label") {
226		label = f.Value("--label")
227	}
228	if label, err = keyLabel(label); err != nil {
229		return c.fail(protocol.ExitUsage, "%v", err)
230	}
231	fp := ssh.FingerprintSHA256(pub)
232	if err := c.Store.AddSSHKeyFrom(c.User.ID, fp, pub.Type(), pub.Marshal(), scope, label, store.KeyOrigin{CreatedByToken: c.TokenID, ExpiresAt: expires}); err != nil {
233		if errors.Is(err, store.ErrDuplicateKey) {
234			return c.failErr(err)
235		}
236		return c.fail(protocol.ExitFailure, "adding key: %v", err)
237	}
238	type out struct {
239		Fingerprint string     `json:"fingerprint"`
240		Scope       string     `json:"scope"`
241		Label       string     `json:"label"`
242		ExpiresAt   *time.Time `json:"expires_at,omitempty"`
243	}
244	d := out{fp, scope, label, expires}
245	return c.emit(d, func(w io.Writer) {
246		line := fmt.Sprintf("added %s (%s)", d.Fingerprint, d.Scope)
247		if d.Label != "" {
248			line += " " + d.Label
249		}
250		if d.ExpiresAt != nil {
251			line += ", expires " + c.expiresText(d.ExpiresAt, time.Now())
252		}
253		fmt.Fprintln(w, line)
254	})
255}
256
257func runKeysLabel(c *Ctx, args []string) int {
258	if len(args) < 1 || len(args) > 2 {
259		return c.usage()
260	}
261	label := ""
262	if len(args) == 2 {
263		label = args[1]
264	}
265	label, err := keyLabel(label)
266	if err != nil {
267		return c.fail(protocol.ExitUsage, "%v", err)
268	}
269	if err := c.Store.SetSSHKeyLabel(c.User.ID, args[0], label); err != nil {
270		if errors.Is(err, store.ErrNotFound) {
271			return c.fail(protocol.ExitNotFound, "no key with fingerprint %s on your account", args[0])
272		}
273		return c.fail(protocol.ExitFailure, "labelling key: %v", err)
274	}
275	d := map[string]string{"fingerprint": args[0], "label": label}
276	return c.emit(d, func(w io.Writer) {
277		if label == "" {
278			fmt.Fprintf(w, "cleared label on %s\n", args[0])
279			return
280		}
281		fmt.Fprintf(w, "%s is now %q\n", args[0], label)
282	})
283}
284
285func runKeysRemove(c *Ctx, args []string) int {
286	if len(args) != 1 {
287		return c.usage()
288	}
289	if err := c.Store.RemoveSSHKey(c.User.ID, args[0]); err != nil {
290		if errors.Is(err, store.ErrNotFound) {
291			return c.fail(protocol.ExitNotFound, "no key with fingerprint %s on your account", args[0])
292		}
293		return c.fail(protocol.ExitFailure, "removing key: %v", err)
294	}
295	return c.emit(map[string]string{"removed": args[0]}, func(w io.Writer) {
296		fmt.Fprintf(w, "removed %s\n", args[0])
297	})
298}