internal/control/runnerrepo.go
143 lines · 5278 bytes
1package control
2
3import (
4 "errors"
5 "fmt"
6 "io"
7
8 "golang.org/x/crypto/ssh"
9
10 "gitbay.org/gitbay/internal/policy"
11 "gitbay.org/gitbay/internal/protocol"
12 "gitbay.org/gitbay/internal/store"
13)
14
15// Runners attached to a repository (#184). A runner key claims builds only
16// for the repositories it is attached to; a repository admin attaches it
17// by pasting the runner's public key. The key lands on the admin's own
18// account with scope runner, which confines it to the runner protocol and
19// read-only git.
20func init() {
21 register(Command{Path: []string{"repo", "runner", "add"},
22 Summary: "attach a runner's public key to a repository",
23 Usage: "repo runner add <owner/name> < key.pub",
24 ReadsStdin: true, Run: runRepoRunnerAdd})
25 register(Command{Path: []string{"repo", "runner", "list"},
26 Summary: "list the runners attached to a repository",
27 Usage: "repo runner list <owner/name>", ReadOnly: true, Run: runRepoRunnerList})
28 register(Command{Path: []string{"repo", "runner", "remove"},
29 Summary: "detach a runner from a repository",
30 Usage: "repo runner remove <owner/name> <fingerprint>", Run: runRepoRunnerRemove})
31}
32
33func runRepoRunnerAdd(c *Ctx, args []string) int {
34 f, err := parseFlags(args, flagSpec{MaxPos: 1, Usage: "repo runner add <owner/name> < key.pub"})
35 if err != nil || len(f.Pos) != 1 {
36 return c.fail(protocol.ExitUsage, "usage: repo runner add <owner/name> < key.pub")
37 }
38 repo, code := resolveRepo(c, f.Pos[0], policy.CanAdmin)
39 if code >= 0 {
40 return code
41 }
42 raw, err := io.ReadAll(io.LimitReader(c.Stdin, 64<<10))
43 if err != nil {
44 return c.fail(protocol.ExitFailure, "reading key: %v", err)
45 }
46 pub, _, _, _, err := ssh.ParseAuthorizedKey(raw)
47 if err != nil {
48 return c.fail(protocol.ExitUsage, "not a valid public key in authorized_keys format: %v", err)
49 }
50 fp := ssh.FingerprintSHA256(pub)
51 key, err := c.Store.SSHKeyByFingerprint(fp)
52 switch {
53 case errors.Is(err, store.ErrNotFound):
54 if err := c.Store.AddSSHKey(c.User.ID, fp, pub.Type(), pub.Marshal(), "runner"); err != nil {
55 return c.fail(protocol.ExitFailure, "adding key: %v", err)
56 }
57 if key, err = c.Store.SSHKeyByFingerprint(fp); err != nil {
58 return c.fail(protocol.ExitFailure, "%v", err)
59 }
60 case err != nil:
61 return c.fail(protocol.ExitFailure, "%v", err)
62 case key.Scope != "runner":
63 // A full key would let a build step administer the account; a
64 // deploy key is bound elsewhere. A runner gets a key of its own.
65 return c.fail(protocol.ExitDenied, "%s is a %s key, not a runner key; give the runner a key of its own", fp, key.Scope)
66 case key.UserID != c.User.ID && !c.User.IsAdmin:
67 return c.fail(protocol.ExitDenied, "%s belongs to another account", fp)
68 }
69 // The runner clones what it builds, so the key's account must be able
70 // to read the repository. The caller's own key needs no check: they
71 // hold admin on the repository to get here.
72 if key.UserID != c.User.ID {
73 owner, err := c.Store.UserByID(key.UserID)
74 if err != nil {
75 return c.fail(protocol.ExitFailure, "%v", err)
76 }
77 grant, err := c.Store.AccessRole(repo.ID, owner.ID)
78 if err != nil {
79 return c.fail(protocol.ExitFailure, "%v", err)
80 }
81 if !policy.CanRead(owner, repo, grant) {
82 return c.fail(protocol.ExitDenied, "%s belongs to %s, who cannot read %s", fp, owner.Username, repo.Path())
83 }
84 }
85 if err := c.Store.AttachRunner(key.ID, repo.ID); err != nil {
86 return c.fail(protocol.ExitFailure, "%v", err)
87 }
88 c.Store.Audit(c.User.ID, "repo.runner.add", map[string]any{"repo": repo.Path(), "fingerprint": fp})
89 d := map[string]string{"fingerprint": fp, "repo": repo.Path()}
90 return c.emit(d, func(w io.Writer) {
91 fmt.Fprintf(w, "runner %s attached to %s\n", fp, repo.Path())
92 })
93}
94
95func runRepoRunnerList(c *Ctx, args []string) int {
96 if len(args) != 1 {
97 return c.fail(protocol.ExitUsage, "usage: repo runner list <owner/name>")
98 }
99 repo, code := resolveRepo(c, args[0], policy.CanAdmin)
100 if code >= 0 {
101 return code
102 }
103 runners, err := c.Store.ListRepoRunners(repo.ID)
104 if err != nil {
105 return c.fail(protocol.ExitFailure, "%v", err)
106 }
107 if runners == nil {
108 runners = []store.RepoRunner{}
109 }
110 return c.emit(runners, func(w io.Writer) {
111 for _, r := range runners {
112 seen := r.LastSeen
113 if seen == "" {
114 seen = "never"
115 }
116 held := "idle"
117 if r.BuildNumber != 0 {
118 held = fmt.Sprintf("%s #%d %s since %s", r.BuildRepo, r.BuildNumber, r.BuildJob, r.StartedAt)
119 }
120 fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n", r.Fingerprint, r.Algo, r.Username, seen, held)
121 }
122 })
123}
124
125func runRepoRunnerRemove(c *Ctx, args []string) int {
126 if len(args) != 2 {
127 return c.fail(protocol.ExitUsage, "usage: repo runner remove <owner/name> <fingerprint>")
128 }
129 repo, code := resolveRepo(c, args[0], policy.CanAdmin)
130 if code >= 0 {
131 return code
132 }
133 if err := c.Store.DetachRunner(repo.ID, args[1]); err != nil {
134 if errors.Is(err, store.ErrNotFound) {
135 return c.fail(protocol.ExitNotFound, "no runner %s on %s", args[1], repo.Path())
136 }
137 return c.fail(protocol.ExitFailure, "%v", err)
138 }
139 c.Store.Audit(c.User.ID, "repo.runner.remove", map[string]any{"repo": repo.Path(), "fingerprint": args[1]})
140 return c.emit(map[string]string{"removed": args[1]}, func(w io.Writer) {
141 fmt.Fprintf(w, "runner %s detached from %s\n", args[1], repo.Path())
142 })
143}