internal/control/runnerrepo.go
151 lines · 5408 bytes
1package control
2
3import (
4 "errors"
5 "fmt"
6 "io"
7
8 "golang.org/x/crypto/ssh"
9
10 "gitbay.org/gitbay/internal/policy"
11 "gitbay.org/gitbay/internal/protocol"
12 "gitbay.org/gitbay/internal/store"
13)
14
15// Runners attached to a repository (#184). A runner key claims builds only
16// for the repositories it is attached to; a repository admin attaches it
17// by pasting the runner's public key. The key lands on the admin's own
18// account with scope runner, which confines it to the runner protocol and
19// read-only git.
20func init() {
21 register(Command{Path: []string{"repo", "runner", "add"},
22 Summary: "attach a runner's public key to a repository",
23 Usage: "repo runner add <owner/name> < key.pub",
24 Examples: []string{"repo runner add krz/gitbay < key.pub"},
25 ReadsStdin: true, Run: runRepoRunnerAdd})
26 register(Command{Path: []string{"repo", "runner", "list"},
27 Summary: "list the runners attached to a repository",
28 Usage: "repo runner list <owner/name>",
29 Examples: []string{"repo runner list krz/gitbay"},
30 ReadOnly: true, Run: runRepoRunnerList})
31 register(Command{Path: []string{"repo", "runner", "remove"},
32 Summary: "detach a runner from a repository",
33 Usage: "repo runner remove <owner/name> <fingerprint>",
34 Examples: []string{"repo runner remove krz/gitbay SHA256:abcd1234"},
35 Run: runRepoRunnerRemove})
36}
37
38func runRepoRunnerAdd(c *Ctx, args []string) int {
39 f, err := parseFlags(args, flagSpec{MaxPos: 1, Usage: "repo runner add <owner/name> < key.pub"})
40 if err != nil || len(f.Pos) != 1 {
41 return c.usage()
42 }
43 repo, code := resolveRepo(c, f.Pos[0], policy.CanAdmin)
44 if code >= 0 {
45 return code
46 }
47 raw, err := io.ReadAll(io.LimitReader(c.Stdin, 64<<10))
48 if err != nil {
49 return c.fail(protocol.ExitFailure, "reading key: %v", err)
50 }
51 pub, comment, _, _, err := ssh.ParseAuthorizedKey(raw)
52 if err != nil {
53 return c.fail(protocol.ExitUsage, "not a valid public key in authorized_keys format: %v", err)
54 }
55 fp := ssh.FingerprintSHA256(pub)
56 key, err := c.Store.SSHKeyByFingerprint(fp)
57 switch {
58 case errors.Is(err, store.ErrNotFound):
59 label, _ := keyLabel(comment)
60 if err := c.Store.AddSSHKey(c.User.ID, fp, pub.Type(), pub.Marshal(), "runner", label); err != nil {
61 return c.fail(protocol.ExitFailure, "adding key: %v", err)
62 }
63 if key, err = c.Store.SSHKeyByFingerprint(fp); err != nil {
64 return c.fail(protocol.ExitFailure, "%v", err)
65 }
66 case err != nil:
67 return c.fail(protocol.ExitFailure, "%v", err)
68 case key.Scope != "runner":
69 // A full key would let a build step administer the account; a
70 // deploy key is bound elsewhere. A runner gets a key of its own.
71 return c.fail(protocol.ExitDenied, "%s is a %s key, not a runner key; give the runner a key of its own", fp, key.Scope)
72 case key.UserID != c.User.ID && !c.User.IsAdmin:
73 return c.fail(protocol.ExitDenied, "%s belongs to another account", fp)
74 }
75 // The runner clones what it builds, so the key's account must be able
76 // to read the repository. The caller's own key needs no check: they
77 // hold admin on the repository to get here.
78 if key.UserID != c.User.ID {
79 owner, err := c.Store.UserByID(key.UserID)
80 if err != nil {
81 return c.fail(protocol.ExitFailure, "%v", err)
82 }
83 grant, err := c.Store.AccessRole(repo.ID, owner.ID)
84 if err != nil {
85 return c.fail(protocol.ExitFailure, "%v", err)
86 }
87 if !policy.CanRead(owner, repo, grant) {
88 return c.fail(protocol.ExitDenied, "%s belongs to %s, who cannot read %s", fp, owner.Username, repo.Path())
89 }
90 }
91 if err := c.Store.AttachRunner(key.ID, repo.ID); err != nil {
92 return c.fail(protocol.ExitFailure, "%v", err)
93 }
94 c.Store.Audit(c.User.ID, "repo.runner.add", map[string]any{"repo": repo.Path(), "fingerprint": fp})
95 d := map[string]string{"fingerprint": fp, "repo": repo.Path()}
96 return c.emit(d, func(w io.Writer) {
97 fmt.Fprintf(w, "runner %s attached to %s\n", fp, repo.Path())
98 })
99}
100
101func runRepoRunnerList(c *Ctx, args []string) int {
102 if len(args) != 1 {
103 return c.usage()
104 }
105 repo, code := resolveRepo(c, args[0], policy.CanAdmin)
106 if code >= 0 {
107 return code
108 }
109 runners, err := c.Store.ListRepoRunners(repo.ID)
110 if err != nil {
111 return c.fail(protocol.ExitFailure, "%v", err)
112 }
113 if runners == nil {
114 runners = []store.RepoRunner{}
115 }
116 return c.emit(runners, func(w io.Writer) {
117 tb := c.table(w, "FINGERPRINT", "ALGO", "USER", "SEEN", "HELD")
118 for _, r := range runners {
119 seen := r.LastSeen
120 if seen == "" {
121 seen = "never"
122 }
123 held := "idle"
124 if r.BuildNumber != 0 {
125 held = fmt.Sprintf("%s #%d %s since %s", r.BuildRepo, r.BuildNumber, r.BuildJob, r.StartedAt)
126 }
127 tb.row(cRef(r.Fingerprint), cText(r.Algo), cText(r.Username), cAge(seen), cText(held))
128 }
129 tb.flush()
130 })
131}
132
133func runRepoRunnerRemove(c *Ctx, args []string) int {
134 if len(args) != 2 {
135 return c.usage()
136 }
137 repo, code := resolveRepo(c, args[0], policy.CanAdmin)
138 if code >= 0 {
139 return code
140 }
141 if err := c.Store.DetachRunner(repo.ID, args[1]); err != nil {
142 if errors.Is(err, store.ErrNotFound) {
143 return c.fail(protocol.ExitNotFound, "no runner %s on %s", args[1], repo.Path())
144 }
145 return c.fail(protocol.ExitFailure, "%v", err)
146 }
147 c.Store.Audit(c.User.ID, "repo.runner.remove", map[string]any{"repo": repo.Path(), "fingerprint": args[1]})
148 return c.emit(map[string]string{"removed": args[1]}, func(w io.Writer) {
149 fmt.Fprintf(w, "runner %s detached from %s\n", args[1], repo.Path())
150 })
151}