paquette 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4d8ed39d45d99f0d96e971b61bd47529362b0efa35f9b2704134628b2001bfa3
+  data.tar.gz: 765118b95e910e0cac4b34b8ddf841471237ef93c87fc5f59a5b62e45b470a04
+SHA512:
+  metadata.gz: fbd2e25eecb61a6c5e6cc2dba5bce5283a434fd65bfd65ef175f813c3d683342b42ed3d3f7f634943ea4b818df4f096a160a8d0a2dda3923e37e5b0f9d57a1c0
+  data.tar.gz: 6e90af21e71e67d05f2ff3f89a26cbb65913a1ce196e62cc03d31e1d003a11411c5d0ce8feb9ebb97c64fc72a0311315ee41f83a2f32c22224a7500e116e5484

data/LICENSE.md

@@ -0,0 +1,10 @@
+# O'Saasy License Agreement
+
+Copyright © 2026 and onwards, Stanquette
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+1. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+2. No licensee or downstream recipient may use the Software (including any modified or derivative versions) to directly compete with the original Licensor by offering it to third parties as a hosted, managed, or Software-as-a-Service (SaaS) product or cloud service where the primary value of the service is the functionality of the Software itself.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,90 @@
+# Paquette
+
+Paquette is a (sligtly unhinged) Rack-based server for libraries. At the moment it serves gems and NPM packages. It is very basic and is made to serve packages gated by a licensing mechanism, which is supposed to be BYO.
+
+Things are very in flux at the moment, but it may come in handy.
+
+## Setup
+
+1. Install dependencies:
+   ```bash
+   bundle install
+   ```
+
+2. Start the server:
+   ```bash
+   bundle exec puma
+   ```
+
+## Repository gating
+
+Paquette is built on the premise that you can have a corpus of libraries you offer, and deduce - from the `Authorization` HTTP header or by other means - which packages a user may download. Only the packages they have access to get included in the API responses - version lists, checksum lists and so on.
+
+`Paquette::GemServer` itself is dumb: it takes one repository object and routes every read, push, and yank through it. You build the stack per request by nesting plain constructors — no DSL, no callbacks registered on the server, just wrappers wrapping wrappers. For example, inside a Rack endpoint:
+
+```ruby
+def call(env)
+  username = env["REMOTE_USER"]
+  user = User.where(login: username).first!
+  packages_dir = Rails.root.join("packages", "gems").to_s
+
+  repo = Paquette::GemServer::DirectoryGemRepository.new(packages_dir)
+
+  repo_with_gating = Paquette::GemServer::ReadGatedRepository.new(repo) do |name:, version: nil|
+    user.license.gem_names.include?(name)
+  end
+
+  repo_with_gating_and_personalization = Paquette::GemServer::Personalizer.new(
+    repo_with_gating,
+    license_key: user.license_key,
+    magic_comment_replacements: {"# paquette_license_info" => user.license_key}
+  )
+
+  Paquette::GemServer.new(repo_with_gating_and_personalization).call(env)
+end
+```
+
+Each line adds one capability:
+
+- `DirectoryGemRepository` reads `.gem` files from disk and accepts pushes and yanks.
+- `ReadGatedRepository` wraps a repository and filters every name/version through the block — unauthorized gems simply stop existing as far as the server is concerned. It also refuses writes outright: if you gate reads, you are saying this caller is not the right party to mutate the corpus, so `add_gem`/`yank_gem` raise `WriteNotAllowed` (which the server turns into a 403).
+- `Personalizer` wraps a repository and rewrites each served `.gem` on the fly to embed the user's license key.
+
+Because the wrappers are plain Ruby objects composed at the call site, per-user state (the `user` variable) is captured by ordinary closures. Drop a wrapper to disable that layer; add another by slotting in one more constructor. Whether the server will accept pushes and yanks is decided by what you build — wrap the base repo in `ReadGatedRepository` and writes are blocked; hand the server a bare `DirectoryGemRepository` (or your own wrapper that permits writes) and they go through.
+
+The server will run on `http://localhost:9292` by default. Note that the NPM registry and the Rubygems registry have to live on separate domains - so they will respond on whichever domain is passed in that has `gems.` or `npm.` as first subdomain. If your OS supports `.localhost` TLDs, you can access `gems.whatever.localhost:9292` and it will respond.
+
+## Usage for gems
+
+Paquette contains a gem server. This is a separate Rack app which you can use without the NPM server, for example - inside of your Rails app. You can interact with it using `gem` commands, as if it were any other gem server, or by just placing stuff on the filesystem.
+
+### Publishing gems into Paquette
+
+You can publish gems two ways. 
+
+1. Place `.gem` files in the `gems/` directory. The filename should follow the format: `gemname-version.gem`
+2. Actually do a `gem push` - from your shell, do `gem push --host http://gems.localhost:9292 pkg/your-gem-0.1.0.gem` 
+
+Note that Paquette will use whichever auth you wrap it with - that is to say, in the default dev setup - _none._ I told you it is slightly unhinged.
+
+### Consuming gems provided by a Paquette server
+
+To install gems from Paquette, set it as source in your Gemfile - and provide auth for whichever auth mechanism you wrap it with:
+
+```ruby
+gem "private_algos", source: "https://tok_998218907784:x-oauth-basic@gems.paquette.acme.com"
+```
+
+### API Endpoints
+
+- `GET /` - Repository info
+- `GET /api/v1/dependencies` - Gem dependencies
+- `GET /api/v1/versions` - Available gem versions
+- `GET /api/v1/names` - Available gem names
+- `GET /api/v1/search.json` - Search gems
+- `GET /gems/{gemname-version.gem}` - Download gem file
+- `POST /api/v1/gems` - Upload gem (basic implementation)
+
+## License
+
+Paquette is offered under the terms of the [O'Sassy license](https://osaasy.dev/) - basically, don't make it into your own product. Use it to sell your libraries. And godspeed!

data/lib/paquette/gem_server/directory_gem_repository.rb

@@ -0,0 +1,154 @@
+require_relative "gem_repository"
+require "rubygems/package"
+require "tempfile"
+
+module Paquette
+  class GemServer
+    # Repository implementation that reads gems from a directory
+    class DirectoryGemRepository < GemRepository
+      class GemAlreadyExists < StandardError; end
+
+      class InvalidGem < StandardError; end
+
+      class GemNotFound < StandardError; end
+
+      class GemYanked < StandardError; end
+
+      def initialize(gems_dir)
+        @gems_dir = gems_dir
+        FileUtils.mkdir_p(@gems_dir)
+      end
+
+      # Persists a .gem file from its raw binary contents. Returns the parsed
+      # spec on success. Raises InvalidGem when the payload can't be opened as
+      # a gem, or GemAlreadyExists if the name+version is already on disk.
+      def add_gem(binary_data)
+        raise InvalidGem, "Empty gem payload" if binary_data.nil? || binary_data.empty?
+
+        tmp = Tempfile.new(["paquette_push", ".gem"])
+        tmp.binmode
+        tmp.write(binary_data)
+        tmp.close
+
+        spec = begin
+          Gem::Package.new(tmp.path).spec
+        rescue Gem::Package::Error, StandardError => e
+          raise InvalidGem, "Could not read gem: #{e.message}"
+        end
+
+        name = spec.name
+        version = spec.version.to_s
+        raise GemYanked, "#{name}-#{version} was yanked and cannot be republished" if tomb_exists?(name, version)
+        raise GemAlreadyExists, "#{name}-#{version} already exists" if gem_exists?(name, version)
+
+        dest_dir = File.join(@gems_dir, name)
+        FileUtils.mkdir_p(dest_dir)
+        FileUtils.mv(tmp.path, gem_file_path(name, version))
+
+        spec
+      ensure
+        tmp&.close unless tmp&.closed?
+        File.unlink(tmp.path) if tmp && File.exist?(tmp.path)
+      end
+
+      # Yanks a gem by renaming its .gem file to .gem.tomb. The tomb prevents
+      # the same name+version from being re-pushed later. Raises GemNotFound
+      # when the gem was never present or already yanked.
+      def yank_gem(gem_name, version)
+        gem_path = gem_file_path(gem_name, version)
+        raise GemNotFound, "#{gem_name}-#{version} not found" unless File.exist?(gem_path)
+
+        FileUtils.mv(gem_path, tomb_file_path(gem_name, version))
+        nil
+      end
+
+      def tomb_file_path(gem_name, version)
+        gem_file_path(gem_name, version) + ".tomb"
+      end
+
+      def tomb_exists?(gem_name, version)
+        File.exist?(tomb_file_path(gem_name, version))
+      end
+
+      def gem_names
+        Dir.glob(File.join(@gems_dir, "*")).select { |path| File.directory?(path) }.map do |package_path|
+          File.basename(package_path)
+        end.sort
+      end
+
+      def gem_versions
+        versions = []
+        gem_names.each do |gem_name|
+          versions_for_gem(gem_name).each do |version|
+            versions << [gem_name, version]
+          end
+        end
+        versions.sort
+      end
+
+      def versions_for_gem(gem_name)
+        gem_dir = File.join(@gems_dir, gem_name)
+        return [] unless Dir.exist?(gem_dir)
+
+        Dir.glob(File.join(gem_dir, "*.gem")).map do |gem_path|
+          filename = File.basename(gem_path, ".gem")
+          if (match = filename.match(/^#{Regexp.escape(gem_name)}-(\d+\.\d+\.\d+.*)$/))
+            match[1]
+          end
+        end.compact.sort
+      end
+
+      def gem_file_path(gem_name, version)
+        File.join(@gems_dir, gem_name, "#{gem_name}-#{version}.gem")
+      end
+
+      def gem_exists?(gem_name, version)
+        File.exist?(gem_file_path(gem_name, version))
+      end
+
+      def gem_spec(gem_name, version)
+        gem_file = gem_file_path(gem_name, version)
+        return nil unless File.exist?(gem_file)
+
+        pkg = Gem::Package.new(gem_file)
+        pkg.spec
+      end
+
+      def gem_dependencies(gem_name, version)
+        spec = gem_spec(gem_name, version)
+        return [] unless spec
+
+        # Only include runtime dependencies, not development dependencies
+        runtime_deps = spec.dependencies.select { |dep| dep.type == :runtime }
+        runtime_deps.map do |dep|
+          {
+            name: dep.name,
+            requirements: dep.requirement.to_s
+          }
+        end
+      end
+
+      def compact_info(gem_name)
+        versions = versions_for_gem(gem_name)
+        return [] if versions.empty?
+
+        require "digest"
+
+        versions.map do |version|
+          spec = gem_spec(gem_name, version)
+          next unless spec
+
+          # Calculate SHA256 checksum of the gem file
+          gem_file = gem_file_path(gem_name, version)
+          checksum = Digest::SHA256.file(gem_file).hexdigest
+
+          # Get required Ruby version from gemspec
+          ruby_version = spec.required_ruby_version&.to_s || ">= 0"
+
+          # Format: version |checksum:sha256_checksum,ruby:required_ruby_version
+          "#{version} |checksum:#{checksum},ruby:#{ruby_version}"
+        end.compact
+      end
+    end
+  end
+end

data/lib/paquette/gem_server/gem_repacker.rb

@@ -0,0 +1,170 @@
+require "rubygems"
+require "rubygems/package"
+require "fileutils"
+require "digest"
+require "tmpdir"
+require "tempfile"
+require "open3"
+
+module Paquette
+  class GemServer
+    class GemRepacker
+      def self.repack(gem_path, gemspec_extras: {}, magic_comment_replacements: {}, files: {}, &block)
+        new(gem_path, gemspec_extras: gemspec_extras, magic_comment_replacements: magic_comment_replacements, files: files).repack(&block)
+      end
+
+      def initialize(gem_path, gemspec_extras: {}, magic_comment_replacements: {}, files: {})
+        @gem_path = gem_path
+        @gemspec_extras = gemspec_extras
+        @magic_comment_replacements = magic_comment_replacements
+        @files = files
+        @temp_dir = nil
+        @unpacked_gem_dir = nil
+      end
+
+      def repack
+        raise ArgumentError, "Gem file not found: #{@gem_path}" unless File.exist?(@gem_path)
+
+        unpack_gem
+        process_ruby_files
+        inject_files
+        new_gem_path = repackage_gem
+        cleanup
+        new_gem_path
+      end
+
+      private
+
+      def unpack_gem
+        @temp_dir = Dir.mktmpdir("gem_repacker")
+        @unpacked_gem_dir = File.join(@temp_dir, "unpacked_gem")
+        FileUtils.mkdir_p(@unpacked_gem_dir)
+
+        # Use gem unpack command to extract the gem
+        _, stderr, status = Open3.capture3("gem unpack #{@gem_path} --target=#{@unpacked_gem_dir}")
+        unless status.success?
+          raise "Failed to unpack gem: #{@gem_path}. Error: #{stderr}"
+        end
+
+        # Find the unpacked gem directory - it should be the only directory in unpacked_gem_dir
+        @gem_dir = Dir.glob(File.join(@unpacked_gem_dir, "*")).find { |path| File.directory?(path) }
+        raise "Could not find unpacked gem directory" unless @gem_dir
+      end
+
+      def process_ruby_files
+        Dir.glob(File.join(@gem_dir, "**", "*.rb")).each do |rb_file|
+          process_ruby_file(rb_file)
+        end
+      end
+
+      def inject_files
+        @files.each do |file_path, content|
+          # Ensure the file path is relative to the gem directory
+          full_path = File.join(@gem_dir, file_path)
+
+          # Create parent directories if they don't exist
+          FileUtils.mkdir_p(File.dirname(full_path))
+
+          # Write the file content
+          File.write(full_path, content)
+        end
+      end
+
+      def process_ruby_file(file_path)
+        # Create a temporary file for output
+        temp_output = Tempfile.new("gem_repacker_output")
+
+        # Open input file in binary mode for reading
+        File.open(file_path, "rb") do |input_file|
+          # Set temp file to binary mode
+          temp_output.binmode
+
+          # Apply magic comment replacements if any are defined
+          if @magic_comment_replacements.any?
+            apply_magic_comment_replacements(input_file, temp_output)
+          else
+            # Just copy the file as-is if no magic comment replacements
+            IO.copy_stream(input_file, temp_output)
+          end
+
+          # Flush the temp file to ensure all data is written
+          temp_output.flush
+        end
+
+        # Replace the original file with the processed content
+        FileUtils.mv(temp_output.path, file_path)
+      ensure
+        temp_output.close
+        temp_output.unlink if File.exist?(temp_output.path)
+      end
+
+      def apply_magic_comment_replacements(input_file, output_file)
+        input_file.each_line do |line|
+          # Check if this line matches any of our magic comment replacements
+          replacement_found = false
+          @magic_comment_replacements.each do |magic_comment, replacement_value|
+            if line.chomp == magic_comment
+              output_file.puts("# #{replacement_value}\n")
+              IO.copy_stream(input_file, output_file) # Copy the rest
+              replacement_found = true
+              break
+            end
+          end
+
+          unless replacement_found
+            output_file.write(line)
+          end
+        end
+      end
+
+      def repackage_gem
+        # Get the original gem specification
+        original_spec = Gem::Package.new(@gem_path).spec
+
+        # Create a gemspec file from the original specification
+        gemspec_path = File.join(@gem_dir, "#{original_spec.name}.gemspec")
+        create_gemspec_file(gemspec_path, original_spec)
+
+        # Build the new gem using gem build command
+        _, stderr, status = Open3.capture3("gem", "build", File.basename(gemspec_path), chdir: @gem_dir)
+        unless status.success?
+          raise "Failed to build gem. Error: #{stderr}"
+        end
+
+        # Find the newly created gem file
+        gem_name = File.basename(@gem_path, ".gem")
+        new_gem_path = File.join(@gem_dir, "#{gem_name}.gem")
+
+        # Move to a more permanent location
+        final_gem_path = File.join(Dir.tmpdir, "#{gem_name}-repacked.gem")
+        FileUtils.mv(new_gem_path, final_gem_path)
+
+        final_gem_path
+      end
+
+      def create_gemspec_file(gemspec_path, spec)
+        # Create a new spec with additional metadata
+        new_spec = spec.dup
+
+        # Add additional metadata keys
+        @gemspec_extras.each do |key, value|
+          new_spec.metadata[key] = value
+        end
+
+        # Add injected files to the files list
+        @files.each do |file_path, _content|
+          new_spec.files << file_path unless new_spec.files.include?(file_path)
+        end
+
+        # Use the built-in to_ruby method to safely serialize the specification
+        gemspec_content = new_spec.to_ruby
+
+        File.write(gemspec_path, gemspec_content)
+      end
+
+      def cleanup
+        FileUtils.rm_rf(@temp_dir) if @temp_dir && Dir.exist?(@temp_dir)
+      end
+    end
+  end
+end

data/lib/paquette/gem_server/gem_repository.rb

@@ -0,0 +1,53 @@
+require "json"
+require "fileutils"
+
+module Paquette
+  class GemServer
+    # Abstract base class for gem repositories
+    class GemRepository
+      def initialize
+        raise NotImplementedError, "GemRepository is an abstract class"
+      end
+
+      # Returns an array of gem names available in the repository
+      def gem_names
+        raise NotImplementedError, "Subclasses must implement gem_names"
+      end
+
+      # Returns an array of [name, version] pairs for all gems
+      def gem_versions
+        raise NotImplementedError, "Subclasses must implement gem_versions"
+      end
+
+      # Returns an array of versions for a specific gem
+      def versions_for_gem(gem_name)
+        raise NotImplementedError, "Subclasses must implement versions_for_gem"
+      end
+
+      # Returns the gem file path for a specific gem and version
+      def gem_file_path(gem_name, version)
+        raise NotImplementedError, "Subclasses must implement gem_file_path"
+      end
+
+      # Returns whether a gem file exists for the given name and version
+      def gem_exists?(gem_name, version)
+        raise NotImplementedError, "Subclasses must implement gem_exists?"
+      end
+
+      # Returns the gem specification for a specific gem and version
+      def gem_spec(gem_name, version)
+        raise NotImplementedError, "Subclasses must implement gem_spec"
+      end
+
+      # Returns dependencies for a specific gem and version
+      def gem_dependencies(gem_name, version)
+        raise NotImplementedError, "Subclasses must implement gem_dependencies"
+      end
+
+      # Returns compact info for a specific gem (all versions)
+      def compact_info(gem_name)
+        raise NotImplementedError, "Subclasses must implement compact_info"
+      end
+    end
+  end
+end

data/lib/paquette/gem_server/personalizer.rb

@@ -0,0 +1,66 @@
+require "delegate"
+require "fileutils"
+require "digest"
+
+module Paquette
+  class GemServer
+    class Personalizer < SimpleDelegator
+      def initialize(repository, license_key:, magic_comment_replacements: {})
+        super(repository)
+        @license_key = license_key
+        @magic_comment_replacements = magic_comment_replacements
+      end
+
+      def gem_file_path(gem_name, version)
+        original_path = __getobj__.gem_file_path(gem_name, version)
+        return original_path unless File.exist?(original_path)
+
+        # Create personalized version
+        personalize_gem(original_path, gem_name, version)
+      end
+
+      def compact_info(gem_name)
+        # Override compact_info to use personalized gems for checksums
+        versions = __getobj__.versions_for_gem(gem_name)
+        return [] if versions.empty?
+
+        versions.map do |version|
+          spec = __getobj__.gem_spec(gem_name, version)
+          next unless spec
+
+          # Use personalized gem file for checksum calculation
+          personalized_gem_file = gem_file_path(gem_name, version)
+          checksum = Digest::SHA256.file(personalized_gem_file).hexdigest
+
+          # Get required Ruby version from gemspec
+          ruby_version = spec.required_ruby_version&.to_s || ">= 0"
+
+          # Format: version |checksum:sha256_checksum,ruby:required_ruby_version
+          "#{version} |checksum:#{checksum},ruby:#{ruby_version}"
+        end.compact
+      end
+
+      private
+
+      def personalize_gem(original_gem_path, gem_name, version)
+        # Create a unique path for the personalized gem
+        personalized_dir = File.join(Dir.tmpdir, "paquette_personalized")
+        FileUtils.mkdir_p(personalized_dir)
+
+        personalized_path = File.join(personalized_dir, "#{gem_name}-#{version}-personalized.gem")
+
+        Paquette::GemServer::GemRepacker.repack(original_gem_path,
+          gemspec_extras: {"paquette.license_key" => @license_key},
+          magic_comment_replacements: @magic_comment_replacements)
+
+        # Move the repacked gem to our personalized location
+        temp_personalized = File.join(Dir.tmpdir, "#{gem_name}-#{version}-repacked.gem")
+        if File.exist?(temp_personalized)
+          FileUtils.mv(temp_personalized, personalized_path)
+        end
+
+        personalized_path
+      end
+    end
+  end
+end

data/lib/paquette/gem_server/read_gated_repository.rb

@@ -0,0 +1,74 @@
+require "delegate"
+
+module Paquette
+  class GemServer
+    # Wraps a gem repository and filters every read through an entitler block.
+    # The block receives `name:` (and optionally `version:`) and returns truthy
+    # when the caller is allowed to see that gem/version. Non-entitled gems
+    # disappear from listings, return nil paths, and report as non-existent.
+    #
+    # Writes (add_gem, yank_gem) always raise WriteNotAllowed. Gating a read
+    # path implies the caller is not the right party to mutate the corpus —
+    # if you want a more nuanced story (e.g. read-gated but write-allowed
+    # for authenticated admins), write a different wrapper with its own
+    # policy. This one is deliberately opinionated: gating reads blocks
+    # writes, full stop.
+    class ReadGatedRepository < SimpleDelegator
+      class WriteNotAllowed < StandardError; end
+
+      def initialize(repository, &entitler)
+        super(repository)
+        @entitler = entitler
+      end
+
+      def gem_names
+        super.select { |name| @entitler.call(name: name) }
+      end
+
+      def gem_versions
+        super.select do |gem_name, version|
+          @entitler.call(name: gem_name, version: version)
+        end
+      end
+
+      def versions_for_gem(gem_name)
+        return [] unless @entitler.call(name: gem_name)
+        super.select do |version|
+          @entitler.call(name: gem_name, version: version)
+        end
+      end
+
+      def gem_file_path(gem_name, version)
+        if @entitler.call(name: gem_name, version: version)
+          super
+        end
+      end
+
+      def compact_info(gem_name)
+        return nil unless @entitler.call(name: gem_name)
+
+        all_info = super
+        return all_info unless all_info.is_a?(Array)
+
+        all_info.select do |line|
+          version = line.split(" ")[0]
+          @entitler.call(name: gem_name, version: version)
+        end
+      end
+
+      def gem_exists?(gem_name, version)
+        if @entitler.call(name: gem_name, version: version)
+          super
+        end
+      end
+
+      def add_gem(*)
+        raise WriteNotAllowed, "Writes are not allowed through a read-gated repository"
+      end
+
+      def yank_gem(*)
+        raise WriteNotAllowed, "Writes are not allowed through a read-gated repository"
+      end
+    end
+  end
+end