ace-lab 0.14.1 → 0.15.1

data/lib/ace/lab/auth/local_command.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "timeout"
+require_relative "error"
+
+module Ace
+  module Lab
+    module Auth
+      # One ordinary child process group. Credentials are environment values,
+      # never argv. Cleanup runs on normal exit, deadline and interruption.
+      # This does not contain a malicious process that leaves its group.
+      class LocalCommand
+        def call(argv, environment, deadline:)
+          remaining = deadline - Time.now
+          raise Refusal, "lease expired before execution" unless remaining.positive?
+
+          pid = Process.spawn(environment, [argv.first, argv.first], *argv.drop(1),
+            unsetenv_others: true, pgroup: true)
+          begin
+            previous = Signal.trap("TERM") { raise SignalException, "TERM" } if Thread.current == Thread.main
+            _, status = Timeout.timeout(remaining) { Process.wait2(pid) }
+            reaped = true
+            status.exitstatus || 128 + status.termsig.to_i
+          rescue Timeout::Error
+            124
+          ensure
+            begin
+              reaped = stop_group(pid, reaped: reaped)
+              Timeout.timeout(2) { Process.wait(pid) } unless reaped
+            rescue Errno::ECHILD
+              nil
+            rescue SystemCallError, Timeout::Error => e
+              raise ExecutionCleanupError, "command process group cleanup is unconfirmed (#{e.class}: #{e.message})"
+            ensure
+              Signal.trap("TERM", previous) if previous
+            end
+          end
+        end
+
+        private
+
+        def stop_group(pid, reaped:)
+          Process.kill("TERM", -pid)
+          sleep 0.05
+          # Darwin reports EPERM when a group contains only our unreaped
+          # zombie. Reap it before checking for surviving descendants.
+          begin
+            reaped ||= !Process.waitpid(pid, Process::WNOHANG).nil?
+          rescue Errno::ECHILD
+            # wait2 may have reaped the leader before an interrupt updated
+            # our flag. Descendants still need the group KILL below.
+            reaped = true
+          end
+          Process.kill("KILL", -pid)
+          reaped
+        rescue Errno::ESRCH
+          reaped
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/auth/plugins/forgejo_provider.rb

@@ -1,48 +1,28 @@
 # frozen_string_literal: true
 
 require "json"
+require "base64"
 require "openssl"
 require "open3"
 require "tempfile"
+require "tmpdir"
+require "fileutils"
+require "uri"
+require "rbconfig"
+require "ipaddr"
+require_relative "../credential_handoff"
 
 module Ace
   module Lab
     module Auth
       module Plugins
-        # Forgejo provider (task 8xs.t.pu0.7): one SEPARATE scoped token
-        # per lease, issued on the configured role account through the
-        # TOKEN-AUTHENTICATED ADMIN API, limited to the profile's
-        # repositories and scopes; revocation deletes that EXACT token
-        # name — never a prefix wipe and never other tasks' tokens.
-        #
-        # Wire contract (PR #398 re-review R1): the issuer credential is
-        # an admin PAT, so both endpoints are the admin variants
-        # (`POST/DELETE /api/v1/admin/users/{account}/tokens`) — the
-        # user-scoped `/api/v1/users/.../tokens` requires BasicAuth or
-        # reverse-proxy auth and does not accept `Authorization: token`.
-        # Repository scoping uses the server's RepoTargetOption shape:
-        # objects with `owner` and `name`. A repo entry without an
-        # owner does not identify anything and is REFUSED before any
-        # request — never an all-repositories token. The creation
-        # response's granted scopes are validated against the request
-        # when the server reports them; a mismatch is a classified
-        # failure, never a trusted grant. Forgejo tokens carry no proven
-        # native TTL across versions, so the profile's expiry comes
-        # from the host's scheduled revoke (expiry_mode host-revoke).
-        #
-        # The token NAME is deterministic from the lease id
-        # (`ace-lab-<lease id>`): it is written to the lease record at
-        # CREATION, so an interrupted issue (lost response, dead
-        # process) can still be settled deterministically — the name is
-        # reconstructed and revoked; a 404 means it never existed
-        # remotely (:already_invalid, an idempotent result).
-        #
-        # Transport is an injectable seam (argv runner/capture shapes):
-        # tests pin the wire contract with fakes emulating the server;
-        # the default runs `curl` with the issuer token from the host's
-        # protected store. The issuer secret is read from its file
-        # reference and never appears in argv of the CHILD.
+        # Forgejo 15 requires Basic authentication with an administrator
+        # credential and Sudo header on the user-token endpoints.  The
+        # credential stays in a private, temporary curl header file.  A
+        # successful issue must prove the returned repository restrictions.
+        # Host-owned issuance and timed revocation are separate requirements.
         class ForgejoProvider
+          ASKPASS = File.expand_path("../../../../../libexec/forgejo-askpass", __dir__).freeze
           def initialize(runner: nil, capture: nil)
             @runner = runner || method(:run_curl)
             @capture = capture || method(:run_capture)
@@ -58,36 +38,75 @@ module Ace
             "ace-lab-#{lease_id}"
           end
 
+          # fj and ACE's Forgejo HTTP adapters read the same XDG login file.
+          # Give this child only its leased token, with no ambient fj aliases
+          # or logins, and remove the private directory when it exits.
+          def with_exec_environment(profile:, credential:)
+            unless linux_xdg?
+              raise Providers::RefusedError, "forgejo session projection currently requires Linux XDG data directories"
+            end
+            issuer = profile["issuer"]
+            url = issuer_origin!(issuer)
+            host = url.hostname
+            authority = host.include?(":") ? "[#{host}]" : host
+            authority += ":#{url.port}" if url.port != url.default_port
+            account = issuer["account"].to_s
+            raise Providers::RefusedError, "forgejo role account is invalid" unless account.match?(/\A[a-zA-Z0-9_.-]+\z/)
+            token = begin
+              File.read(credential).strip
+            rescue SystemCallError => e
+              raise Providers::RefusedError, "forgejo lease credential is unreadable (#{e.class.name})"
+            end
+            raise Providers::RefusedError, "forgejo lease credential is empty" if token.empty?
+            prefix = CredentialHandoff.projection_prefix(credential)
+            Dir.mktmpdir(prefix, File.dirname(credential)) do |dir|
+              login_dir = File.join(dir, "forgejo-cli")
+              Dir.mkdir(login_dir, 0o700)
+              File.open(File.join(login_dir, "keys.json"), File::WRONLY | File::CREAT | File::EXCL, 0o600) do |file|
+                file.write(JSON.generate({"hosts" => {authority => {"type" => "Application", "token" => token}},
+                  "aliases" => {}, "default_ssh" => []}))
+              end
+              yield({"XDG_DATA_HOME" => dir, "GIT_ASKPASS" => ASKPASS, "GIT_TERMINAL_PROMPT" => "0",
+                "GIT_CONFIG_COUNT" => "2", "GIT_CONFIG_KEY_0" => "credential.helper", "GIT_CONFIG_VALUE_0" => "",
+                "GIT_CONFIG_KEY_1" => "credential.useHttpPath", "GIT_CONFIG_VALUE_1" => "false", "LC_ALL" => "C.UTF-8",
+                "ACE_LAB_FORGEJO_ORIGIN" => "#{url.scheme}://#{authority}", "ACE_LAB_FORGEJO_SCHEME" => url.scheme,
+                "ACE_LAB_FORGEJO_AUTHORITY" => authority, "ACE_LAB_FORGEJO_ACCOUNT" => account})
+            end
+          end
+
           def issue(profile:, lease:)
-            issuer = profile.fetch("issuer")
-            url = issuer["url"] or raise Providers::RefusedError, "forgejo profile has no issuer url"
+            issuer = profile["issuer"]
+            url = issuer_origin!(issuer).to_s.chomp("/")
             account = issuer["account"] or raise Providers::RefusedError, "forgejo profile has no role account"
-            token_file = issuer["token_file"] or raise Providers::RefusedError,
-              "forgejo profile has no issuer token_file reference"
-            raise Providers::RefusedError, "issuer token file '#{token_file}' is not readable" unless File.readable?(token_file)
+            header_value = issuer_header(issuer)
 
             token_name = token_ref_for(lease_id: lease["id"])
             scopes = profile.fetch("scopes")
-            repositories = repo_targets(lease.fetch("repos"))
+            requested_repos = lease.fetch("repos")
+            repositories = repo_targets(requested_repos)
 
             payload = JSON.generate({
               "name" => token_name,
               "scopes" => scopes,
               "repositories" => repositories
             }.compact)
-            result = with_secret_header("Authorization: token #{File.read(token_file).strip}") do |header|
+            result = with_secret_header(header_value) do |header|
               @runner.call(
-                ["curl", "-sS", "-f", "-X", "POST",
-                  "#{url}/api/v1/admin/users/#{account}/tokens",
+                ["curl", "-q", "--connect-timeout", "5", "--max-time", "20", "-sS", "-f", "-X", "POST",
+                  "#{url}/api/v1/users/#{account}/tokens",
                   "-H", "Content-Type: application/json",
                   *header,
                   "-d", payload]
               )
             end
             body = JSON.parse(result)
-            secret = body["sha1"] or raise Providers::TransientError,
-              "forgejo did not return the token secret (check server API version)"
+            raise Providers::TransientError, "forgejo returned an invalid token response" unless body.is_a?(Hash)
+            secret = body["sha1"]
+            unless secret.is_a?(String) && !secret.empty?
+              raise Providers::TransientError, "forgejo did not return the token secret (check server API version)"
+            end
             validate_granted_scopes(body, scopes)
+            validate_granted_repositories(body, requested_repos)
 
             {"token" => secret, "token_ref" => token_name,
              "provider_expiry" => nil,
@@ -102,19 +121,19 @@ module Ace
           # contract. 404 is the idempotent already-invalid result —
           # deterministic recovery of an interrupted issue.
           def revoke(profile:, token_ref:, token: nil)
-            issuer = profile.fetch("issuer")
-            url = issuer["url"] or raise Providers::RefusedError, "forgejo profile has no issuer url"
+            issuer = profile["issuer"]
+            url = issuer_origin!(issuer).to_s.chomp("/")
             account = issuer["account"] or raise Providers::RefusedError, "forgejo profile has no role account"
-            token_file = issuer["token_file"]
-            _out, err, status = with_secret_header("Authorization: token #{File.read(token_file).strip}") do |header|
+            _out, err, status = with_secret_header(issuer_header(issuer)) do |header|
               @capture.call(
-                ["curl", "-sS", "-f", "-X", "DELETE",
-                  "#{url}/api/v1/admin/users/#{account}/tokens/#{token_ref}",
+                ["curl", "-q", "--connect-timeout", "5", "--max-time", "20", "-sS", "-f", "-X", "DELETE",
+                  "#{url}/api/v1/users/#{account}/tokens/#{token_ref}",
                   *header]
               )
             end
             return :revoked if status.success?
-            return :already_invalid if err.to_s.match?(/\b404\b/)
+            return :already_invalid if status.exitstatus == 22 &&
+              err.to_s.match?(/(?:\A|\n)curl: \(22\) The requested URL returned error: 404\s*(?:\n|\z)/)
 
             raise Providers::TransientError,
               "forgejo revoke failed: #{err.to_s.lines.first&.strip}"
@@ -122,6 +141,54 @@ module Ace
 
           private
 
+          def linux_xdg?
+            RbConfig::CONFIG.fetch("host_os").start_with?("linux")
+          end
+
+          def issuer_origin!(issuer)
+            raise Providers::RefusedError, "forgejo issuer is invalid" unless issuer.is_a?(Hash)
+            url = URI.parse(issuer.fetch("url"))
+            unless %w[http https].include?(url.scheme) && url.host && url.userinfo.nil? &&
+                ["", "/"].include?(url.path.to_s) && url.query.nil? && url.fragment.nil?
+              raise Providers::RefusedError, "forgejo issuer url must be a bare HTTP(S) origin"
+            end
+            if url.scheme == "http" && !loopback_host?(url.hostname)
+              raise Providers::RefusedError, "forgejo issuer requires HTTPS except on loopback"
+            end
+            url
+          rescue URI::InvalidURIError, KeyError, TypeError
+            raise Providers::RefusedError, "forgejo issuer url is invalid"
+          end
+
+          def loopback_host?(host)
+            return true if host.casecmp?("localhost")
+
+            IPAddr.new(host).loopback?
+          rescue IPAddr::InvalidAddressError
+            false
+          end
+
+          def issuer_header(issuer)
+            account = issuer["account"].to_s
+            username = issuer["admin_username"].to_s
+            path = issuer["password_file"].to_s
+            unless account.match?(/\A[a-zA-Z0-9_.-]+\z/) && username.match?(/\A[a-zA-Z0-9_.-]+\z/)
+              raise Providers::RefusedError, "forgejo issuer account and admin_username must be valid user names"
+            end
+            raise Providers::RefusedError, "forgejo issuer password file is not readable" unless File.file?(path) && File.readable?(path)
+            password = File.read(path).strip
+            raise Providers::RefusedError, "forgejo issuer password is empty" if password.empty?
+            "Authorization: Basic #{Base64.strict_encode64("#{username}:#{password}")}\nSudo: #{account}"
+          end
+
+          def validate_granted_repositories(body, requested)
+            repos = body["repositories"]
+            granted = repos.map { |repo| repo.is_a?(Hash) ? repo["full_name"].to_s.downcase : "" }.sort if repos.is_a?(Array)
+            return if granted && granted == requested.map { |repo| repo.to_s.downcase }.sort
+
+            raise Providers::TransientError, "forgejo did not confirm the requested repository restrictions"
+          end
+
           # RepoTargetOption: {"owner" =>, "name" =>} objects parsed
           # from `owner/name` entries. An entry without an owner does
           # not identify a repository — refusing beats issuing an
@@ -145,12 +212,10 @@ module Ace
             end
           end
 
-          # The response's granted scopes (when the server reports
-          # them) must cover the request — the enforced scope is the
-          # server's answer, never the request's claim.
+          # The server's answer, not the request, establishes the grant.
           def validate_granted_scopes(body, requested)
             granted = body["scopes"]
-            return unless granted.is_a?(Array)
+            raise Providers::TransientError, "forgejo did not confirm granted scopes" unless granted.is_a?(Array)
 
             missing = requested.map(&:to_s) - granted.map(&:to_s)
             unless missing.empty?
@@ -158,6 +223,9 @@ module Ace
                 "forgejo granted scopes [#{granted.join(', ')}] do not cover the " \
                 "requested [#{missing.join(', ')}]; refusing the grant"
             end
+            unless (granted.map(&:to_s) - requested.map(&:to_s)).empty?
+              raise Providers::TransientError, "forgejo granted unrequested scopes; refusing the grant"
+            end
           end
 
           # The Authorization secret NEVER appears in curl argv (visible

data/lib/ace/lab/auth/profile_schema.rb

@@ -69,6 +69,11 @@ module Ace
             roles = string_list(raw["roles"], name, "roles")
             principals = string_list(raw["principals"], name, "principals")
             repos = string_list(raw["repos"], name, "repos")
+            env_names = string_list(raw["env_names"], name, "env_names")
+            if env_names.any? { |value| value.include?("=") || value.include?("\0") }
+              raise Ace::Lab::InvalidConfigurationError,
+                "auth profile '#{name}' env_names cannot contain '=' or NUL"
+            end
             ttl = positive_minutes(raw["ttl_minutes"], name, DEFAULT_TTL_MINUTES)
             max_ttl = positive_minutes(raw["max_ttl_minutes"], name, DEFAULT_MAX_TTL_MINUTES)
             raise_conflict(name, "ttl_minutes exceeds max_ttl_minutes") if ttl > max_ttl
@@ -92,7 +97,7 @@ module Ace
              "ttl_minutes" => ttl, "max_ttl_minutes" => max_ttl,
              "expiry_mode" => expiry_mode,
              "issuer" => raw["issuer"].is_a?(Hash) ? raw["issuer"] : {},
-             "env_names" => string_list(raw["env_names"], name, "env_names")}
+             "env_names" => env_names}
           end
 
           def default_expiry_mode(provider)

data/lib/ace/lab/auth/providers.rb

@@ -23,6 +23,9 @@ module Ace
       #     {"token" => secret (never serialized), "token_ref" => provider id,
       #      "provider_expiry" => time-ish | nil, "via" => handoff descriptor}
       #     or raises RefusedError / TransientError / OutcomeUnknownError
+      #     RefusedError guarantees no credential was issued. If issuance
+      #     may have happened, the provider must raise OutcomeUnknownError
+      #     or TransientError so recovery never treats the outcome as closed.
       #   revoke(profile:, token_ref:, token:) -> :revoked | :already_invalid |
       #     raises TransientError / OutcomeUnknownError
       #     (`token` is the issued secret from the handoff — providers
@@ -31,6 +34,11 @@ module Ace
       #     id ignore it; a 404-shaped unknown id settles as
       #     :already_invalid so interrupted issues recover
       #     deterministically)
+      #   with_exec_environment(profile:, credential:) { |env| ... }
+      #     optional scoped child-environment projection. Raise RefusedError
+      #     before dispatch on failure; clean up temporary secrets when the
+      #     block exits. Crash-recoverable projections use the existing
+      #     CredentialHandoff.projection_prefix lifecycle.
       class Providers
         class RefusedError < StandardError; end
         class TransientError < StandardError; end