@davidvornholt/standards 0.14.0 → 0.15.0

package/src/creds-r2.ts

@@ -0,0 +1,117 @@
+// Cloudflare R2 ground truth for the credential broker, pinned by
+// creds-r2.test.ts against https://developers.cloudflare.com/r2/api/tokens/:
+// a bucket-scoped token targets the resource
+// `com.cloudflare.edge.r2.bucket.<account_id>_<jurisdiction>_<bucket>`, and
+// the S3-compatible credential pair derived from a minted token is access
+// key ID = the token's ID, secret access key = the SHA-256 hex digest of the
+// token's value.
+
+import { createHash } from 'node:crypto';
+import type { SopsValueChange } from './creds-sops';
+
+// Scope the permission_groups endpoint reports for the bucket-item groups
+// ("Workers R2 Storage Bucket Item Read"/"... Write"); account-scoped groups
+// report `com.cloudflare.api.account` instead.
+export const R2_BUCKET_SCOPE = 'com.cloudflare.edge.r2.bucket';
+
+export type R2Jurisdiction = 'default' | 'eu';
+export const DEFAULT_R2_JURISDICTION: R2Jurisdiction = 'default';
+
+export const isR2Jurisdiction = (value: string): value is R2Jurisdiction =>
+  value === DEFAULT_R2_JURISDICTION || value === 'eu';
+
+// R2 bucket names are 3-63 characters of lowercase letters, digits, and
+// hyphens, starting and ending alphanumeric.
+const BUCKET_NAME = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/u;
+
+export const isR2BucketName = (name: string): boolean => BUCKET_NAME.test(name);
+
+export const r2BucketResource = (
+  accountId: string,
+  bucket: string,
+  jurisdiction: R2Jurisdiction = DEFAULT_R2_JURISDICTION,
+): string => `${R2_BUCKET_SCOPE}.${accountId}_${jurisdiction}_${bucket}`;
+
+export const deriveS3SecretAccessKey = (tokenValue: string): string =>
+  createHash('sha256').update(tokenValue).digest('hex');
+
+export const s3Endpoint = (
+  accountId: string,
+  jurisdiction: R2Jurisdiction = DEFAULT_R2_JURISDICTION,
+): string =>
+  `https://${accountId}.${jurisdiction === 'eu' ? 'eu.' : ''}r2.cloudflarestorage.com`;
+
+export type DestinationFormat = 'bearer' | 's3';
+
+const ACCESS_KEY_SEGMENT = 'access_key_id';
+const SECRET_KEY_SEGMENT = 'secret_access_key';
+const S3_PAIR_SEGMENTS = [ACCESS_KEY_SEGMENT, SECRET_KEY_SEGMENT] as const;
+
+export const s3AccessKeyPath = (key: string): string =>
+  `${key}.${ACCESS_KEY_SEGMENT}`;
+
+export const s3PairPaths = (key: string): ReadonlyArray<string> => [
+  s3AccessKeyPath(key),
+  `${key}.${SECRET_KEY_SEGMENT}`,
+];
+
+export const destinationFootprint = (
+  format: DestinationFormat,
+  key: string,
+): ReadonlyArray<string> => (format === 's3' ? s3PairPaths(key) : [key]);
+
+export const destinationFootprintsIntersect = (
+  left: ReadonlyArray<string>,
+  right: ReadonlyArray<string>,
+): boolean => left.some((path) => right.includes(path));
+
+// The SOPS writes for one minted token: a bearer destination stores the raw
+// token value at the key itself; an S3 destination stores the derived
+// credential pair under it.
+export const destinationWrites = (
+  format: DestinationFormat,
+  key: string,
+  tokenId: string,
+  tokenValue: string,
+): ReadonlyArray<SopsValueChange> =>
+  format === 'bearer'
+    ? [{ path: key, value: tokenValue }]
+    : [
+        { path: `${key}.${ACCESS_KEY_SEGMENT}`, value: tokenId },
+        {
+          path: `${key}.${SECRET_KEY_SEGMENT}`,
+          value: deriveS3SecretAccessKey(tokenValue),
+        },
+      ];
+
+// Reconciliation infers a destination's format from the plaintext SOPS key
+// structure: a leaf at the key is a bearer token, both pair leaves under it
+// are an S3 credential, and one pair leaf without the other is unsafe to
+// mutate automatically.
+export const destinationFormatOf = (
+  keys: ReadonlySet<string> | undefined,
+  key: string,
+): DestinationFormat | 'partial' | 'absent' => {
+  if (keys === undefined) {
+    return 'absent';
+  }
+  if (keys.has(key)) {
+    return 'bearer';
+  }
+  const present = s3PairPaths(key).filter((path) => keys.has(path));
+  if (present.length === S3_PAIR_SEGMENTS.length) {
+    return 's3';
+  }
+  return present.length === 0 ? 'absent' : 'partial';
+};
+
+export const inferredDestinationFootprint = (
+  keys: ReadonlySet<string> | undefined,
+  key: string,
+): ReadonlyArray<string> => {
+  const format = destinationFormatOf(keys, key);
+  return destinationFootprint(
+    format === 's3' || format === 'partial' ? 's3' : 'bearer',
+    key,
+  );
+};

package/src/creds-sops.ts

@@ -189,10 +189,3 @@ export const setSopsValues = (
     problem: `could not write ${paths} into ${rel}${detail ? `: ${detail}` : ''}`,
   };
 };
-
-export const setSopsValue = (
-  consumer: string,
-  rel: string,
-  path: string,
-  value: string,
-): SopsWriteResult => setSopsValues(consumer, rel, [{ path, value }]);

package/src/poller-codex.ts

@@ -34,6 +34,13 @@ type CodexExecutor = (
 
 const defaultExecutor: CodexExecutor = execFileSync;
 
+type CodexRunOptions = {
+  readonly workDir: string;
+  readonly gitCommonDir: string;
+  readonly prompt: string;
+  readonly config: PollerConfig;
+};
+
 const exitCause = (details: Record<string, unknown>): string => {
   if (typeof details.status === 'number') {
     return `exit status ${details.status}`;
@@ -57,11 +64,10 @@ const agentEnv = (): Record<string, string | undefined> => {
 };
 
 export const runCodex = (
-  workDir: string,
-  prompt: string,
-  config: PollerConfig,
+  options: CodexRunOptions,
   execute: CodexExecutor = defaultExecutor,
 ): CodexRunResult => {
+  const { workDir, gitCommonDir, prompt, config } = options;
   rmSync(join(workDir, OUTCOME_DIR), { recursive: true, force: true });
   try {
     execute(
@@ -72,6 +78,8 @@ export const runCodex = (
         workDir,
         '--sandbox',
         'workspace-write',
+        '--add-dir',
+        gitCommonDir,
         '-c',
         'sandbox_workspace_write.network_access=true',
         '-m',

package/src/poller-fix-run.ts

@@ -139,9 +139,10 @@ export const runFixJob = async (
     workspace,
   };
   try {
-    const run = runCodex(
-      workspace.dir,
-      fixPrompt({
+    const run = runCodex({
+      workDir: workspace.dir,
+      gitCommonDir: cacheClone,
+      prompt: fixPrompt({
         repo,
         issueNumber: issue.number,
         title: currentIssue.title,
@@ -149,7 +150,7 @@ export const runFixJob = async (
         answers: preamble.answers,
       }),
       config,
-    );
+    });
     await validateFixClaim(job);
     const outcome = run.succeeded ? await readFixOutcome(workspace.dir) : null;
     if (outcome === null) {

package/src/poller-review-execution.ts

@@ -36,17 +36,18 @@ export const executeReviewJob = async (options: {
     ),
   );
   try {
-    const run = runCodex(
-      workspace.dir,
-      reviewPrompt({
+    const run = runCodex({
+      workDir: workspace.dir,
+      gitCommonDir: cacheClone,
+      prompt: reviewPrompt({
         repo: deps.repo,
         prNumber: pr.number,
         title: pr.title,
         baseSha: reviewBase,
         answers,
       }),
-      deps.config,
-    );
+      config: deps.config,
+    });
     await validateReviewClaim({
       deps,
       pr,