mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
1ab6e799c1
go.mod still declared `module github.com/hanzoai/deploy` after the repo was renamed. A Go module path is not cosmetic — it is the resolvable location. So `go get github.com/hanzoai/cd` could not work, and anything importing this module had to spell a name that no longer exists at that address. The build log of v3.6.0 is where it surfaced: the compiler was still emitting github.com/hanzoai/deploy/cmd/cd/commands. 3541 import paths across 690 .go, 19 .proto, 4 .yaml, 3 .sh, 2 .mod, Procfile and Makefile. Plus the 62 ghcr.io/hanzoai/deploy image references, moved to ghcr.io/hanzoai/cd to match hanzo.yml's build target — a distinct string from the module path, replaced separately so neither could clobber the other. go mod tidy clean, CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./... clean. Co-authored-by: Hanzo Dev <[email protected]>
200 lines
6.8 KiB
Go
200 lines
6.8 KiB
Go
package repocreds
|
|
|
|
import (
|
|
"context"
|
|
"reflect"
|
|
|
|
"github.com/hanzoai/cd/util/cd"
|
|
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
|
|
repocredspkg "github.com/hanzoai/cd/pkg/apiclient/repocreds"
|
|
appsv1 "github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
"github.com/hanzoai/cd/util/db"
|
|
"github.com/hanzoai/cd/util/rbac"
|
|
)
|
|
|
|
// Server provides a Repository service
|
|
type Server struct {
|
|
db db.DB
|
|
enf *rbac.Enforcer
|
|
}
|
|
|
|
// NewServer returns a new instance of the Repository service
|
|
func NewServer(
|
|
db db.DB,
|
|
enf *rbac.Enforcer,
|
|
) *Server {
|
|
return &Server{
|
|
db: db,
|
|
enf: enf,
|
|
}
|
|
}
|
|
|
|
// ListRepositoryCredentials returns a list of all configured repository credential sets
|
|
func (s *Server) ListRepositoryCredentials(ctx context.Context, _ *repocredspkg.RepoCredsQuery) (*appsv1.RepoCredsList, error) {
|
|
urls, err := s.db.ListRepositoryCredentials(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
items := make([]appsv1.RepoCreds, 0)
|
|
for _, url := range urls {
|
|
if s.enf.Enforce(ctx.Value("claims"), rbac.ResourceRepositories, rbac.ActionGet, url) {
|
|
repo, err := s.db.GetRepositoryCredentials(ctx, url)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if repo != nil {
|
|
items = append(items, appsv1.RepoCreds{
|
|
URL: url,
|
|
Username: repo.Username,
|
|
Type: repo.Type,
|
|
EnableOCI: repo.EnableOCI,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
return &appsv1.RepoCredsList{Items: items}, nil
|
|
}
|
|
|
|
// ListWriteRepositoryCredentials returns a list of all configured repository credential sets
|
|
func (s *Server) ListWriteRepositoryCredentials(ctx context.Context, _ *repocredspkg.RepoCredsQuery) (*appsv1.RepoCredsList, error) {
|
|
urls, err := s.db.ListRepositoryCredentials(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
items := make([]appsv1.RepoCreds, 0)
|
|
for _, url := range urls {
|
|
if s.enf.Enforce(ctx.Value("claims"), rbac.ResourceWriteRepositories, rbac.ActionGet, url) {
|
|
repo, err := s.db.GetWriteRepositoryCredentials(ctx, url)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if repo != nil && repo.Password != "" {
|
|
items = append(items, appsv1.RepoCreds{
|
|
URL: url,
|
|
Username: repo.Username,
|
|
Type: repo.Type,
|
|
EnableOCI: repo.EnableOCI,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
return &appsv1.RepoCredsList{Items: items}, nil
|
|
}
|
|
|
|
// CreateRepositoryCredentials creates a new credential set in the configuration
|
|
func (s *Server) CreateRepositoryCredentials(ctx context.Context, q *repocredspkg.RepoCredsCreateRequest) (*appsv1.RepoCreds, error) {
|
|
if q.Creds == nil {
|
|
return nil, status.Errorf(codes.InvalidArgument, "missing payload in request")
|
|
}
|
|
if err := s.enf.EnforceErr(ctx.Value("claims"), rbac.ResourceRepositories, rbac.ActionCreate, q.Creds.URL); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
r := q.Creds
|
|
|
|
if r.URL == "" {
|
|
return nil, status.Errorf(codes.InvalidArgument, "must specify URL")
|
|
}
|
|
|
|
_, err := s.db.CreateRepositoryCredentials(ctx, r)
|
|
if status.Convert(err).Code() == codes.AlreadyExists {
|
|
// act idempotent if existing spec matches new spec
|
|
existing, getErr := s.db.GetRepositoryCredentials(ctx, r.URL)
|
|
if getErr != nil {
|
|
return nil, status.Errorf(codes.Internal, "unable to check existing repository credentials details: %v", getErr)
|
|
}
|
|
|
|
switch {
|
|
case reflect.DeepEqual(existing, r):
|
|
err = nil
|
|
case q.Upsert:
|
|
return s.UpdateRepositoryCredentials(ctx, &repocredspkg.RepoCredsUpdateRequest{Creds: r})
|
|
default:
|
|
return nil, status.Error(codes.InvalidArgument, cd.GenerateSpecIsDifferentErrorMessage("repository credentials", existing, r))
|
|
}
|
|
}
|
|
return &appsv1.RepoCreds{URL: r.URL}, err
|
|
}
|
|
|
|
// CreateWriteRepositoryCredentials creates a new credential set in the configuration
|
|
func (s *Server) CreateWriteRepositoryCredentials(ctx context.Context, q *repocredspkg.RepoCredsCreateRequest) (*appsv1.RepoCreds, error) {
|
|
if q.Creds == nil {
|
|
return nil, status.Errorf(codes.InvalidArgument, "missing payload in request")
|
|
}
|
|
if err := s.enf.EnforceErr(ctx.Value("claims"), rbac.ResourceWriteRepositories, rbac.ActionCreate, q.Creds.URL); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
r := q.Creds
|
|
|
|
if r.URL == "" {
|
|
return nil, status.Errorf(codes.InvalidArgument, "must specify URL")
|
|
}
|
|
|
|
_, err := s.db.CreateWriteRepositoryCredentials(ctx, r)
|
|
if status.Convert(err).Code() == codes.AlreadyExists {
|
|
// act idempotent if existing spec matches new spec
|
|
existing, getErr := s.db.GetWriteRepositoryCredentials(ctx, r.URL)
|
|
if getErr != nil {
|
|
return nil, status.Errorf(codes.Internal, "unable to check existing repository credentials details: %v", getErr)
|
|
}
|
|
|
|
switch {
|
|
case reflect.DeepEqual(existing, r):
|
|
err = nil
|
|
case q.Upsert:
|
|
return s.UpdateWriteRepositoryCredentials(ctx, &repocredspkg.RepoCredsUpdateRequest{Creds: r})
|
|
default:
|
|
return nil, status.Error(codes.InvalidArgument, cd.GenerateSpecIsDifferentErrorMessage("repository credentials", existing, r))
|
|
}
|
|
}
|
|
return &appsv1.RepoCreds{URL: r.URL}, err
|
|
}
|
|
|
|
// UpdateRepositoryCredentials updates a repository credential set
|
|
func (s *Server) UpdateRepositoryCredentials(ctx context.Context, q *repocredspkg.RepoCredsUpdateRequest) (*appsv1.RepoCreds, error) {
|
|
if q.Creds == nil {
|
|
return nil, status.Errorf(codes.InvalidArgument, "missing payload in request")
|
|
}
|
|
if err := s.enf.EnforceErr(ctx.Value("claims"), rbac.ResourceRepositories, rbac.ActionUpdate, q.Creds.URL); err != nil {
|
|
return nil, err
|
|
}
|
|
_, err := s.db.UpdateRepositoryCredentials(ctx, q.Creds)
|
|
return &appsv1.RepoCreds{URL: q.Creds.URL}, err
|
|
}
|
|
|
|
// UpdateWriteRepositoryCredentials updates a repository credential set
|
|
func (s *Server) UpdateWriteRepositoryCredentials(ctx context.Context, q *repocredspkg.RepoCredsUpdateRequest) (*appsv1.RepoCreds, error) {
|
|
if q.Creds == nil {
|
|
return nil, status.Errorf(codes.InvalidArgument, "missing payload in request")
|
|
}
|
|
if err := s.enf.EnforceErr(ctx.Value("claims"), rbac.ResourceWriteRepositories, rbac.ActionUpdate, q.Creds.URL); err != nil {
|
|
return nil, err
|
|
}
|
|
_, err := s.db.UpdateWriteRepositoryCredentials(ctx, q.Creds)
|
|
return &appsv1.RepoCreds{URL: q.Creds.URL}, err
|
|
}
|
|
|
|
// DeleteRepositoryCredentials removes a credential set from the configuration
|
|
func (s *Server) DeleteRepositoryCredentials(ctx context.Context, q *repocredspkg.RepoCredsDeleteRequest) (*repocredspkg.RepoCredsResponse, error) {
|
|
if err := s.enf.EnforceErr(ctx.Value("claims"), rbac.ResourceRepositories, rbac.ActionDelete, q.Url); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err := s.db.DeleteRepositoryCredentials(ctx, q.Url)
|
|
return &repocredspkg.RepoCredsResponse{}, err
|
|
}
|
|
|
|
// DeleteWriteRepositoryCredentials removes a credential set from the configuration
|
|
func (s *Server) DeleteWriteRepositoryCredentials(ctx context.Context, q *repocredspkg.RepoCredsDeleteRequest) (*repocredspkg.RepoCredsResponse, error) {
|
|
if err := s.enf.EnforceErr(ctx.Value("claims"), rbac.ResourceWriteRepositories, rbac.ActionDelete, q.Url); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
err := s.db.DeleteWriteRepositoryCredentials(ctx, q.Url)
|
|
return &repocredspkg.RepoCredsResponse{}, err
|
|
}
|