Commit `9f77ab1b00`

9f77ab1b00d30c62a47e7dad42a868942e7b7c4f

parent: b711b70da5

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-28 06:25 UTC

store: announce key revocations; LiveSSHKeys

Ref #256

Layout: unified · split

internal/store/revoke.go added +60

@@ -0,0 +1,60 @@
	1	package store
	2
	3	import (
	4	"slices"
	5	"strings"
	6	)
	7
	8	// Revoked names SSH keys that stopped being valid: by id, or every key
	9	// of an account. The SSH listener closes the connections they opened.
	10	type Revoked struct {
	11	KeyIDs []int64
	12	UserID int64 // every key of this account; 0 for none
	13	}
	14
	15	// OnRevoke registers f to run after each revocation this process
	16	// commits. Revocations committed by another process (gitbayd admin on
	17	// the host) are not announced; the listener's sweep finds those.
	18	func (s *Store) OnRevoke(f func(Revoked)) {
	19	s.revokeMu.Lock()
	20	defer s.revokeMu.Unlock()
	21	s.onRevoke = append(s.onRevoke, f)
	22	}
	23
	24	// announce runs the subscribers. Call it after the commit, outside any
	25	// transaction.
	26	func (s *Store) announce(r Revoked) {
	27	s.revokeMu.Lock()
	28	fs := slices.Clone(s.onRevoke)
	29	s.revokeMu.Unlock()
	30	for _, f := range fs {
	31	f(r)
	32	}
	33	}
	34
	35	// LiveSSHKeys reports which of ids still name a registered key on an
	36	// account that is not disabled.
	37	func (s *Store) LiveSSHKeys(ids []int64) (map[int64]bool, error) {
	38	live := map[int64]bool{}
	39	if len(ids) == 0 {
	40	return live, nil
	41	}
	42	args := make([]any, len(ids))
	43	for i, id := range ids {
	44	args[i] = id
	45	}
	46	rows, err := s.DB.Query(`SELECT k.id FROM ssh_keys k JOIN users u ON u.id = k.user_id
	47	WHERE u.disabled = 0 AND k.id IN (?`+strings.Repeat(", ?", len(ids)-1)+`)`, args...)
	48	if err != nil {
	49	return nil, err
	50	}
	51	defer rows.Close()
	52	for rows.Next() {
	53	var id int64
	54	if err := rows.Scan(&id); err != nil {
	55	return nil, err
	56	}
	57	live[id] = true
	58	}
	59	return live, rows.Err()
	60	}

internal/store/revoke_test.go added +107

@@ -0,0 +1,107 @@
	1	package store
	2
	3	import (
	4	"slices"
	5	"testing"
	6	)
	7
	8	func revokeFixture(t testing.T) (Store, int64, *[]Revoked) {
	9	t.Helper()
	10	s := open(t)
	11	if err := s.MigrateUp(); err != nil {
	12	t.Fatal(err)
	13	}
	14	uid, err := s.CreateUser("alice", false)
	15	if err != nil {
	16	t.Fatal(err)
	17	}
	18	var got []Revoked
	19	s.OnRevoke(func(r Revoked) { got = append(got, r) })
	20	return s, uid, &got
	21	}
	22
	23	func keyID(t testing.T, s Store, fp string) int64 {
	24	t.Helper()
	25	k, err := s.SSHKeyByFingerprint(fp)
	26	if err != nil {
	27	t.Fatal(err)
	28	}
	29	return k.ID
	30	}
	31
	32	func TestRemovalsAnnounceTheirKeys(t *testing.T) {
	33	s, uid, got := revokeFixture(t)
	34	if err := s.AddSSHKey(uid, "SHA256:a", "ssh-ed25519", []byte("a"), "full", ""); err != nil {
	35	t.Fatal(err)
	36	}
	37	if err := s.AddSSHKey(uid, "SHA256:d", "ssh-ed25519", []byte("d"), "deploy:7:ro", ""); err != nil {
	38	t.Fatal(err)
	39	}
	40	a, d := keyID(t, s, "SHA256:a"), keyID(t, s, "SHA256:d")
	41
	42	if err := s.RemoveSSHKey(uid, "SHA256:a"); err != nil {
	43	t.Fatal(err)
	44	}
	45	if err := s.RemoveDeployKey(7, "SHA256:d"); err != nil {
	46	t.Fatal(err)
	47	}
	48	if err := s.SetUserDisabled(uid, true); err != nil {
	49	t.Fatal(err)
	50	}
	51	if err := s.SetUserDisabled(uid, false); err != nil {
	52	t.Fatal(err)
	53	}
	54	want := []Revoked{{KeyIDs: []int64{a}}, {KeyIDs: []int64{d}}, {UserID: uid}}
	55	if !slices.EqualFunc(*got, want, func(x, y Revoked) bool {
	56	return slices.Equal(x.KeyIDs, y.KeyIDs) && x.UserID == y.UserID
	57	}) {
	58	t.Fatalf("announced %+v, want %+v (enabling announces nothing)", *got, want)
	59	}
	60	// A removal that found nothing announces nothing.
	61	if err := s.RemoveSSHKey(uid, "SHA256:a"); err != ErrNotFound {
	62	t.Fatalf("second remove: %v", err)
	63	}
	64	if len(*got) != 3 {
	65	t.Fatalf("a miss was announced: %+v", *got)
	66	}
	67	}
	68
	69	func TestDeleteUserAnnounces(t *testing.T) {
	70	s, uid, got := revokeFixture(t)
	71	if err := s.DeleteUser(uid); err != nil {
	72	t.Fatal(err)
	73	}
	74	if len(got) != 1 \|\| (got)[0].UserID != uid {
	75	t.Fatalf("announced %+v", *got)
	76	}
	77	}
	78
	79	func TestLiveSSHKeys(t *testing.T) {
	80	s, uid, _ := revokeFixture(t)
	81	bob, err := s.CreateUser("bob", false)
	82	if err != nil {
	83	t.Fatal(err)
	84	}
	85	for _, k := range []struct {
	86	uid int64
	87	fp string
	88	}{{uid, "SHA256:a"}, {bob, "SHA256:b"}} {
	89	if err := s.AddSSHKey(k.uid, k.fp, "ssh-ed25519", []byte(k.fp), "full", ""); err != nil {
	90	t.Fatal(err)
	91	}
	92	}
	93	a, b := keyID(t, s, "SHA256:a"), keyID(t, s, "SHA256:b")
	94	if _, err := s.DB.Exec("UPDATE users SET disabled = 1 WHERE id = ?", bob); err != nil {
	95	t.Fatal(err)
	96	}
	97	live, err := s.LiveSSHKeys([]int64{a, b, 999})
	98	if err != nil {
	99	t.Fatal(err)
	100	}
	101	if !live[a] \|\| live[b] \|\| live[999] {
	102	t.Fatalf("live = %v; want only %d", live, a)
	103	}
	104	if live, err := s.LiveSSHKeys(nil); err != nil \|\| len(live) != 0 {
	105	t.Fatalf("no ids: %v %v", live, err)
	106	}
	107	}

internal/store/store.go +4

 	// by the next change to that build's row (BuildLogWait).
 	logMu   sync.Mutex
 	logWait map[int64]chan struct{}
+	// onRevoke runs after each key revocation this process commits.
+	revokeMu sync.Mutex
+	onRevoke []func(Revoked)
 }
 // Open opens (creating if needed) the database at path with WAL mode and

internal/store/users.go +28 −14

 	if n, _ := res.RowsAffected(); n == 0 {
 		return ErrNotFound
 	}
+	s.announce(Revoked{UserID: id})
 	return nil
 }
 // SetUserDisabled suspends or restores an account. Disabling drops every
 // credential that would grant a session on its own — web sessions, API
 // tokens, unclaimed login links — and leaves the SSH keys registered but
-// refused at every entry point until re-enabled.
+// refused at every entry point until re-enabled; connections they opened
+// are closed.
 func (s *Store) SetUserDisabled(userID int64, disabled bool) error {
 	v := 0
 	if disabled {
 				return err
 			}
 		}
+		s.announce(Revoked{UserID: userID})
 	}
 	return err
 }
 	return tx.Commit()
 }
-// RemoveSSHKey removes a key owned by userID and bumps the key epoch.
+// RemoveSSHKey removes a key owned by userID, bumps the key epoch, and
+// announces the revocation.
 func (s *Store) RemoveSSHKey(userID int64, fingerprint string) error {
 	tx, err := s.DB.Begin()
 	if err != nil {
 		return err
 	}
 	defer tx.Rollback()
-	res, err := tx.Exec("DELETE FROM ssh_keys WHERE user_id = ? AND fingerprint = ?", userID, fingerprint)
+	var id int64
+	err = tx.QueryRow("DELETE FROM ssh_keys WHERE user_id = ? AND fingerprint = ? RETURNING id", userID, fingerprint).Scan(&id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return ErrNotFound
+	}
 	if err != nil {
 		return err
 	}
-	if n, _ := res.RowsAffected(); n == 0 {
-		return ErrNotFound
-	}
 	if err := bumpKeyEpoch(tx); err != nil {
 		return err
 	}
-	return tx.Commit()
+	if err := tx.Commit(); err != nil {
+		return err
+	}
+	s.announce(Revoked{KeyIDs: []int64{id}})
+	return nil
 }
 // SetSSHKeyLabel renames a key owned by userID. Labels do not touch the
 		return err
 	}
 	defer tx.Rollback()
-	res, err := tx.Exec(
+	var id int64
-		"DELETE FROM ssh_keys WHERE fingerprint = ? AND scope LIKE 'deploy:' || ? || ':%'",
+	err = tx.QueryRow(
-		fingerprint, repoID)
+		"DELETE FROM ssh_keys WHERE fingerprint = ? AND scope LIKE 'deploy:' || ? || ':%' RETURNING id",
+		fingerprint, repoID).Scan(&id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return ErrNotFound
+	}
 	if err != nil {
 		return err
 	}
-	if n, _ := res.RowsAffected(); n == 0 {
-		return ErrNotFound
-	}
 	if err := bumpKeyEpoch(tx); err != nil {
 		return err
 	}
-	return tx.Commit()
+	if err := tx.Commit(); err != nil {
+		return err
+	}
+	s.announce(Revoked{KeyIDs: []int64{id}})
+	return nil
 }

Commit 9f77ab1b00

Commit `9f77ab1b00`