hammerkit 1.24.0 → 1.25.0

package/dist/server/git-checkout.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkoutRef = exports.isValidRef = void 0;
+exports.resolveRef = exports.RefError = exports.checkoutRef = exports.isValidRef = void 0;
 const child_process_1 = require("child_process");
 const promises_1 = require("fs/promises");
 const util_1 = require("util");
@@ -20,7 +20,10 @@ exports.isValidRef = isValidRef;
  * caller's. Credentials come from the git configuration of the server, there is no
  * prompt a run could hang on.
  */
-async function checkoutRef(repository, ref, directory, env, signal) {
+async function checkoutRef(repository, ref, directory, env, signal, 
+// the commit the ref was resolved to when the run was submitted: a ref that moved since
+// is not what was approved
+expectedCommit) {
     if (!isValidRef(ref)) {
         throw new Error(`${JSON.stringify(ref.slice(0, 80))} is not a branch, tag or commit`);
     }
@@ -29,9 +32,58 @@ async function checkoutRef(repository, ref, directory, env, signal) {
     await run(['init', '--quiet', directory]);
     await run(['-C', directory, 'fetch', '--quiet', '--depth', '1', '--', repository, ref]);
     await run(['-C', directory, '-c', 'advice.detachedHead=false', 'checkout', '--quiet', 'FETCH_HEAD']);
-    return (await run(['-C', directory, 'rev-parse', 'HEAD'])).trim();
+    const commit = (await run(['-C', directory, 'rev-parse', 'HEAD'])).trim();
+    if (expectedCommit && commit !== expectedCommit) {
+        throw new Error(`${ref} is at ${commit} now, the run was submitted for ${expectedCommit}`);
+    }
+    return commit;
 }
 exports.checkoutRef = checkoutRef;
+class RefError extends Error {
+}
+exports.RefError = RefError;
+const COMMIT = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+/**
+ * The commit a branch or tag of a repository points to now: `refs/heads/<ref>`, else
+ * `refs/tags/<ref>` (the commit of an annotated tag). A name that is both a branch and
+ * a tag is ambiguous. A full commit hash is taken as it is.
+ */
+async function resolveRef(repository, ref, env, signal) {
+    if (!isValidRef(ref)) {
+        throw new RefError(`${JSON.stringify(ref.slice(0, 80))} is not a branch, tag or commit`);
+    }
+    if (COMMIT.test(ref.toLowerCase())) {
+        return ref.toLowerCase();
+    }
+    const output = await git([
+        'ls-remote',
+        '--heads',
+        '--tags',
+        '--',
+        repository,
+        `refs/heads/${ref}`,
+        `refs/tags/${ref}`,
+        `refs/tags/${ref}^{}`,
+    ], env, signal, `the refs of ${repository}`);
+    const found = new Map();
+    for (const line of output.split('\n')) {
+        const [commit, name] = line.split('\t');
+        if (commit && name) {
+            found.set(name, commit);
+        }
+    }
+    const branch = found.get(`refs/heads/${ref}`);
+    const tag = found.get(`refs/tags/${ref}^{}`) ?? found.get(`refs/tags/${ref}`);
+    if (branch && tag) {
+        throw new RefError(`${ref} is both a branch and a tag, name one of them`);
+    }
+    const commit = branch ?? tag;
+    if (!commit) {
+        throw new RefError(`there is no branch or tag ${ref}`);
+    }
+    return commit;
+}
+exports.resolveRef = resolveRef;
 async function git(args, baseEnv, signal, what) {
     const env = {};
     for (const [key, value] of Object.entries(baseEnv)) {

package/dist/server/plan.js

@@ -0,0 +1,296 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectBundle = exports.planBundle = exports.DefinitionError = void 0;
+const promises_1 = require("fs/promises");
+const os_1 = require("os");
+const path_1 = require("path");
+const yaml_1 = require("yaml");
+const get_file_context_1 = require("../file/get-file-context");
+const resolve_git_source_1 = require("../includes/resolve-git-source");
+const schema_parser_1 = require("../schema/schema-parser");
+const reference_parser_1 = require("../schema/reference-parser");
+const work_scope_parser_1 = require("../schema/work-scope-parser");
+const work_task_1 = require("../planner/work-task");
+const work_service_1 = require("../planner/work-service");
+const log_1 = require("../log");
+const parse_error_1 = require("../schema/parse-error");
+class DefinitionError extends Error {
+}
+exports.DefinitionError = DefinitionError;
+// 40 (sha-1) or 64 (sha-256) hex digits
+const COMMIT_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
+// A hash alone can only name what is inside the bundle, so everything a build
+// file pulls in from elsewhere has to be pinned: a git include needs a commit
+// and a remote that is not a path on the server.
+function findLooseIncludes(bundle, noRemote = false) {
+    const problems = [];
+    for (const [path, content] of Object.entries(bundle.files)) {
+        if (!/\.ya?ml$/i.test(path)) {
+            continue;
+        }
+        let document;
+        try {
+            document = (0, yaml_1.parse)(content);
+        }
+        catch {
+            continue; // a file that isn't valid yaml is reported when the bundle is parsed
+        }
+        for (const block of ['includes', 'references']) {
+            for (const [name, include] of Object.entries(document?.[block] ?? {})) {
+                const source = include;
+                if (!source || typeof source !== 'object' || source.git === undefined) {
+                    continue;
+                }
+                if (noRemote) {
+                    problems.push(`${path}: ${block}.${name}: a proposal may not include from git, the server would fetch it before anybody approved it`);
+                    continue;
+                }
+                if (typeof source.git !== 'string' || !/^(https:\/\/|ssh:\/\/|git@[\w.-]+:)/.test(source.git)) {
+                    problems.push(`${path}: ${block}.${name}: git has to be an https:// or ssh:// address`);
+                }
+                if (typeof source.ref !== 'string' || !COMMIT_PATTERN.test(source.ref)) {
+                    problems.push(`${path}: ${block}.${name}: pin ref to a commit, a branch or tag can move`);
+                }
+            }
+        }
+    }
+    return problems;
+}
+// What a build file may not name on a server: the places it would run or store things
+// are the operator's. The docker host, a Kubernetes cluster and a remote cache are
+// credentials of the machine, not of the build file, and a project file that could carry
+// them could send runs, or the cache, anywhere.
+function findHostProblems(bundle) {
+    const problems = [];
+    for (const [path, content] of Object.entries(bundle.files)) {
+        if (!/\.ya?ml$/i.test(path)) {
+            continue;
+        }
+        let document;
+        try {
+            document = (0, yaml_1.parse)(content);
+        }
+        catch {
+            continue; // reported when the bundle is parsed
+        }
+        if (!document || typeof document !== 'object') {
+            continue;
+        }
+        if (document.environments && Object.keys(document.environments).length > 0) {
+            problems.push(`${path}: environments pick a docker host or a Kubernetes cluster, which are the server's to choose, remove them`);
+        }
+        for (const [name, cache] of Object.entries(document.caches ?? {})) {
+            if (cache?.backend?.type !== 'local' || cache.backend.path !== undefined) {
+                problems.push(`${path}: caches.${name}: a server keeps its own cache, a build file names no backend or path`);
+            }
+        }
+        for (const [name, service] of Object.entries(document.services ?? {})) {
+            if (service &&
+                typeof service === 'object' &&
+                ('selector' in service || 'kubeconfig' in service || 'context' in service)) {
+                problems.push(`${path}: services.${name}: Kubernetes services are not supported on a server`);
+            }
+        }
+    }
+    return problems;
+}
+// What a build file may read while it is inspected: its own files. The rest of
+// the server is not its business (a missing file is "not there", not an error).
+function confined(files, root) {
+    const check = (path) => {
+        if (!(0, resolve_git_source_1.isWithin)(root, (0, path_1.resolve)(root, path))) {
+            throw new DefinitionError(`${path} is outside of the bundle`);
+        }
+    };
+    const guarded = (fn) => (path) => {
+        check(path);
+        return fn.call(files, path);
+    };
+    return {
+        ...files,
+        read: guarded(files.read),
+        readStream: guarded(files.readStream),
+        listFiles: guarded(files.listFiles),
+        stats: guarded(files.stats),
+        exists: async (path) => (0, resolve_git_source_1.isWithin)(root, (0, path_1.resolve)(root, path)) && files.exists(path),
+        watch: files.watch,
+    };
+}
+// A path of a task, written relative to the root of the bundle with forward
+// slashes. A leading `!` (an exclusion) is kept. Nothing is returned for a path
+// outside of the bundle.
+function insideBundle(root, cwd, path) {
+    const negated = path.startsWith('!');
+    const absolute = (0, path_1.resolve)(cwd, negated ? path.slice(1) : path);
+    const inside = (0, path_1.relative)(root, absolute);
+    if (inside === '..' || inside.startsWith(`..${path_1.sep}`) || (0, path_1.isAbsolute)(inside)) {
+        return [];
+    }
+    const portable = inside.split(path_1.sep).join(path_1.posix.sep);
+    // a pattern keeps its glob characters, `resolve` only normalizes separators
+    return [`${negated ? '!' : ''}${portable === '' ? '.' : portable}`];
+}
+function itemsOf(workTree) {
+    return [...Object.values(workTree.tasks), ...Object.values(workTree.services)];
+}
+function secretsOf(item) {
+    return 'secrets' in item.data ? item.data.secrets : [];
+}
+function describeSecret(secret) {
+    const target = secret.target.type === 'env' ? secret.target.name : secret.target.path;
+    const source = secret.source;
+    if (source.type === 'provider') {
+        return { from: `${source.provider}:${source.ref}`, account: source.account, target };
+    }
+    return { from: source.type === 'env' ? `env:${source.name}` : `file:${source.path}`, account: null, target };
+}
+// What a server refuses to publish. A secret that reads a file or a variable of the
+// server has no account, so nothing would stand between the build file and the
+// operator's own credentials.
+function findPolicyProblems(items, policy, root) {
+    const problems = [];
+    for (const item of items) {
+        const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
+        if (policy.runtimes && !policy.runtimes.includes(runtime)) {
+            problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
+        }
+        const data = item.data;
+        if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
+            for (const mount of data.mounts) {
+                // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
+                if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
+                    problems.push(`${item.name}: mounts ${mount.localPath}, which is outside of the bundle`);
+                }
+            }
+        }
+        for (const secret of secretsOf(item)) {
+            const source = secret.source;
+            if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+            }
+            else if (source.type === 'file') {
+                problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+            }
+            else if (source.type === 'env' && !policy.envs.includes(source.name)) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in runs.env.allow`);
+            }
+        }
+    }
+    return problems;
+}
+function toPlan(root, item) {
+    const data = item.data;
+    const secrets = secretsOf(item).map(describeSecret);
+    const accounts = [...new Set(secrets.flatMap((secret) => (secret.account ? [secret.account] : [])))].sort();
+    const mounts = (0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)
+        ? data.mounts.map((mount) => {
+            const inside = insideBundle(root, data.cwd, mount.localPath);
+            return `${inside.length > 0 ? inside[0] : mount.localPath}:${mount.containerPath}${mount.readOnly ? ':ro' : ''}`;
+        })
+        : [];
+    const ports = 'ports' in data ? data.ports.map((port) => `${port.hostPort ?? ''}:${port.containerPort}`) : [];
+    const flags = [];
+    if (data.type === 'local-task') {
+        flags.push('local-task');
+    }
+    if ('ports' in data && data.ports.some((port) => port.hostPort !== null)) {
+        flags.push('host-port');
+    }
+    if (data.scope.remote) {
+        flags.push('remote-include');
+    }
+    const isTask = data.type === 'local-task' || data.type === 'container-task';
+    return {
+        kind: isTask ? 'task' : 'service',
+        runtime: data.type === 'local-task' ? 'local' : 'docker',
+        ...((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data) ? { image: data.image } : {}),
+        cmds: 'cmds' in data ? data.cmds.map((cmd) => cmd.cmd) : 'cmd' in data && data.cmd ? [data.cmd.cmd] : [],
+        deps: item.deps.map((dep) => dep.name).sort(),
+        needs: item.needs.map((need) => need.name).sort(),
+        accounts,
+        secrets,
+        mounts,
+        ports,
+        generates: 'generates' in data ? data.generates.map((generate) => generate.path) : [],
+        flags,
+    };
+}
+// A file that does not match the schema says where, not only that it does not.
+function describeFailure(e) {
+    if (e instanceof parse_error_1.ParseError) {
+        const issue = e.zod.issues[0];
+        return `${e.buildFilePath}: ${issue.path.length > 0 ? `${issue.path.join('.')}: ` : ''}${issue.message}`;
+    }
+    return (0, log_1.getErrorMessage)(e);
+}
+// Writes the bundle into a directory of its own and reads it the way a run
+// would, so a build file that doesn't parse is refused when it is published, not
+// when somebody wants to run it. The same function answers what a run will do,
+// with the scope of the run: which tasks, services and accounts it involves.
+async function planBundle(bundle, environment, options = {}) {
+    const problems = [...findLooseIncludes(bundle, options.noRemote), ...(options.policy ? findHostProblems(bundle) : [])];
+    if (problems.length > 0) {
+        throw new DefinitionError(problems.join('\n'));
+    }
+    const directory = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), 'hammerkit-definition-'));
+    try {
+        for (const [path, content] of Object.entries(bundle.files)) {
+            await (0, promises_1.mkdir)((0, path_1.dirname)((0, path_1.join)(directory, path)), { recursive: true });
+            await (0, promises_1.writeFile)((0, path_1.join)(directory, path), content);
+        }
+        const inspected = {
+            ...environment,
+            cwd: directory,
+            file: confined((0, get_file_context_1.getFileContext)(directory), directory),
+        };
+        try {
+            const { ctx, scope } = await (0, schema_parser_1.createParseContext)((0, path_1.join)(directory, bundle.entry), inspected);
+            const context = await (0, reference_parser_1.parseReferences)(ctx, scope, inspected);
+            const workTree = (0, work_scope_parser_1.getWorkContext)(context, options.scope ?? { environmentName: null }, inspected);
+            const items = itemsOf(workTree);
+            if (options.policy) {
+                const policyProblems = findPolicyProblems(items, options.policy, directory);
+                if (policyProblems.length > 0) {
+                    throw new DefinitionError(policyProblems.join('\n'));
+                }
+            }
+            const inputs = {};
+            for (const item of Object.values(workTree.tasks)) {
+                inputs[item.name] = {
+                    // the sources a task inherits from its dependencies belong to those
+                    src: item.data.src
+                        .filter((source) => source.inherited === null)
+                        .flatMap((source) => insideBundle(directory, item.data.cwd, source.source)),
+                    mounts: (0, work_task_1.isContainerWorkTask)(item.data)
+                        ? item.data.mounts.flatMap((mount) => insideBundle(directory, item.data.cwd, mount.localPath))
+                        : [],
+                    deps: item.deps.map((dep) => dep.name).sort(),
+                    needs: item.needs.map((need) => need.name).sort(),
+                };
+            }
+            const plan = {};
+            for (const item of items) {
+                plan[item.name] = toPlan(directory, item);
+            }
+            const sorted = (record) => Object.fromEntries(Object.entries(record).sort(([a], [b]) => (a < b ? -1 : 1)));
+            return {
+                tasks: Object.keys(context.tasks).sort(),
+                services: Object.keys(context.services).sort(),
+                inputs: sorted(inputs),
+                plan: sorted(plan),
+                accounts: [...new Set(Object.values(plan).flatMap((entry) => entry.accounts))].sort(),
+            };
+        }
+        catch (e) {
+            throw new DefinitionError(describeFailure(e).split(directory).join('.'));
+        }
+    }
+    finally {
+        await (0, promises_1.rm)(directory, { recursive: true, force: true });
+    }
+}
+exports.planBundle = planBundle;
+// Reads a bundle the way a run would; see planBundle.
+const inspectBundle = (bundle, environment) => planBundle(bundle, environment);
+exports.inspectBundle = inspectBundle;
+//# sourceMappingURL=plan.js.map

package/dist/server/policy.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getGrant = exports.isAdmin = exports.maySeeDefinitions = exports.mayPropose = exports.mayPublish = exports.matches = void 0;
+exports.decideRun = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayRun = exports.matches = void 0;
+const repo_1 = require("./repo");
+const BUILDS_ORDER = ['run', 'propose', 'publish'];
 function matches(entitlement, principal) {
     if (entitlement.subject) {
         return entitlement.subject.iss === principal.iss && entitlement.subject.sub === principal.sub;
@@ -15,76 +17,122 @@ function matches(entitlement, principal) {
     return false;
 }
 exports.matches = matches;
-function mayPublish(grant, name) {
-    return grant.publish.includes('*') || grant.publish.includes(name);
-}
-exports.mayPublish = mayPublish;
-function mayPropose(grant, name) {
-    return grant.propose.includes('*') || grant.propose.includes(name);
+function atLeast(grant, level) {
+    return grant.builds !== null && BUILDS_ORDER.indexOf(grant.builds) >= BUILDS_ORDER.indexOf(level);
 }
+const mayRun = (grant) => atLeast(grant, 'run');
+exports.mayRun = mayRun;
+const mayPropose = (grant) => atLeast(grant, 'propose');
 exports.mayPropose = mayPropose;
+const mayPublish = (grant) => atLeast(grant, 'publish');
+exports.mayPublish = mayPublish;
 // A caller who can neither run nor publish anything sees nothing of the server's
-// build files either. Admins see them, they have to know what they approve.
+// build files either. Someone who uses an account sees them: they have to know what
+// they approve.
 function maySeeDefinitions(grant) {
-    return grant.accounts.length > 0 || grant.request.length > 0 || grant.publish.length > 0 || grant.propose.length > 0;
+    return grant.builds !== null || Object.keys(grant.accounts).length > 0;
 }
 exports.maySeeDefinitions = maySeeDefinitions;
-// Admin of an account decides about the runs on it.
-function isAdmin(grant, account) {
-    return account !== null && grant.accounts.includes(account);
+// `use` includes deciding about the runs others request on the account.
+function canUse(grant, account) {
+    return grant.accounts[account] === 'use';
+}
+exports.canUse = canUse;
+// Pulling a version back is a safe thing to do, so it is open to who publishes the build
+// file, and to who uses an account the version works with: they are the ones who
+// answer for what runs as it.
+function mayYank(grant, version) {
+    return (0, exports.mayPublish)(grant) || (version.accounts ?? []).some((account) => canUse(grant, account));
+}
+exports.mayYank = mayYank;
+function usedAccounts(grant) {
+    return Object.keys(grant.accounts).filter((account) => grant.accounts[account] === 'use');
 }
-exports.isAdmin = isAdmin;
-// Default deny: a caller without a matching entitlement gets no account.
+exports.usedAccounts = usedAccounts;
+// Default deny: a caller without a matching entitlement gets nothing.
 function getGrant(entitlements, principal) {
     const matched = [];
-    const accounts = [];
-    const requested = [];
-    const publish = [];
-    const propose = [];
-    let defaultAccount = null;
-    let source = null;
+    const accounts = {};
+    const repos = [];
+    let builds = null;
     entitlements.forEach((entitlement, index) => {
         if (!matches(entitlement, principal)) {
             return;
         }
         matched.push(index);
-        for (const account of entitlement.accounts) {
-            if (!accounts.includes(account)) {
-                accounts.push(account);
+        for (const [account, level] of Object.entries(entitlement.accounts)) {
+            if (accounts[account] !== 'use') {
+                accounts[account] = level;
             }
         }
-        for (const account of entitlement.request ?? []) {
-            if (!requested.includes(account)) {
-                requested.push(account);
+        for (const repo of entitlement.repos) {
+            if (!repos.includes(repo)) {
+                repos.push(repo);
             }
         }
-        for (const name of entitlement.publish ?? []) {
-            if (!publish.includes(name)) {
-                publish.push(name);
-            }
+        if (entitlement.builds &&
+            (builds === null || BUILDS_ORDER.indexOf(entitlement.builds) > BUILDS_ORDER.indexOf(builds))) {
+            builds = entitlement.builds;
         }
-        for (const name of entitlement.propose ?? []) {
-            if (!propose.includes(name)) {
-                propose.push(name);
+    });
+    return { accounts, repos, builds, matched };
+}
+exports.getGrant = getGrant;
+const COMMIT = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
+// The single place that decides what happens to a run that was submitted: it
+// starts, waits for an approval, or is refused with the reason.
+function decideRun(input) {
+    const { grant, accounts, catalog, source, approvable, readable } = input;
+    if (!(0, exports.mayRun)(grant)) {
+        return { type: 'refuse', status: 403, error: 'you are not entitled to run anything on this server' };
+    }
+    if (source.type === 'upload') {
+        return {
+            type: 'refuse',
+            status: 501,
+            error: 'runs from an upload are not supported by this server yet, use a git ref',
+        };
+    }
+    // the caller's own list first: what they may not name is not told whether the server can read it
+    if (!(0, repo_1.matchesAnyRepo)(grant.repos, source.repo)) {
+        return {
+            type: 'refuse',
+            status: 403,
+            error: grant.repos.length > 0
+                ? `you may not run from ${source.repo}, your repositories are ${grant.repos.join(', ')}`
+                : `you may not run from ${source.repo}, no entitlement of yours lists a repository`,
+        };
+    }
+    if (!readable(source.repo)) {
+        return { type: 'refuse', status: 400, error: `this server can not read ${source.repo}` };
+    }
+    const request = [];
+    for (const account of accounts) {
+        const level = grant.accounts[account];
+        if (level === undefined) {
+            return { type: 'refuse', status: 403, error: `you may not use the account ${account}, it needs use or request` };
+        }
+        const rules = catalog[account];
+        if (rules?.source && !rules.source.includes(source.type)) {
+            return { type: 'refuse', status: 403, error: `the account ${account} is not used by runs from ${source.type}` };
+        }
+        if (rules?.refs) {
+            if (COMMIT.test(source.ref) || !(0, repo_1.matchesRef)(rules.refs, source.ref)) {
+                return {
+                    type: 'refuse',
+                    status: 403,
+                    error: `the account ${account} is only used by runs from ${rules.refs.join(', ')}`,
+                };
             }
         }
-        defaultAccount = defaultAccount ?? entitlement.default ?? null;
-        if (entitlement.source) {
-            source = source ? source.filter((s) => entitlement.source?.includes(s)) : [...entitlement.source];
+        if (level === 'request') {
+            if (!approvable(account)) {
+                return { type: 'refuse', status: 409, error: `nobody can approve ${account}, no entitlement uses it` };
+            }
+            request.push(account);
         }
-    });
-    // admin wins over request when two entitlements give both
-    const request = requested.filter((account) => !accounts.includes(account));
-    const usable = [...accounts, ...request];
-    return {
-        accounts,
-        request,
-        publish,
-        propose,
-        default: defaultAccount ?? (usable.length === 1 ? usable[0] : null),
-        source: source ?? ['upload', 'ref'],
-        matched,
-    };
+    }
+    return request.length > 0 ? { type: 'approval', accounts: request } : { type: 'run' };
 }
-exports.getGrant = getGrant;
+exports.decideRun = decideRun;
 //# sourceMappingURL=policy.js.map

package/dist/server/proposals-api.js

@@ -1,30 +1,42 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleProposals = void 0;
+exports.handleProposals = exports.mayApprove = void 0;
 const zod_1 = require("zod");
 const bundle_1 = require("../remote/bundle");
 const definitions_1 = require("./definitions");
 const http_1 = require("./http");
 const oauth_1 = require("./oauth");
 const policy_1 = require("./policy");
+const proposals_1 = require("./proposals");
 const server_config_1 = require("./server-config");
 const decisionSchema = zod_1.z.object({ reason: zod_1.z.string().max(500).optional() }).strict();
 const same = (a, b) => a.iss === b.iss && a.sub === b.sub;
+// Whoever approves publishes it, and uses the accounts its proposer did not: a
+// version that names an account is approved by somebody the account trusts.
+const mayApprove = (grant, proposal) => (0, policy_1.mayPublish)(grant) && proposal.missing.every((account) => (0, policy_1.canUse)(grant, account));
+exports.mayApprove = mayApprove;
 // What the caller is shown of a proposal: what it is, who proposed it and the
 // version it would replace, so the files can be compared.
 function toView(store, proposal, principal, grant) {
+    const latest = store.find(proposal.name, 'latest')?.hash ?? null;
+    const stale = proposal.state === 'waiting' && latest !== proposal.base;
     return {
         ...proposal,
-        base: store.find(proposal.name, 'latest')?.hash ?? null,
+        // the version it follows is fixed when it is proposed; if another one was
+        // published since, it can only be rejected
+        latest,
+        stale,
         mine: same(proposal.proposedBy, principal),
-        // approving needs the permission to publish the name, and somebody else's proposal
-        canDecide: proposal.state === 'waiting' && (0, policy_1.mayPublish)(grant, proposal.name) && !same(proposal.proposedBy, principal),
+        // approving needs the permission to publish, the accounts the proposer lacked, and
+        // somebody else's proposal
+        canDecide: proposal.state === 'waiting' && !stale && (0, exports.mayApprove)(grant, proposal) && !same(proposal.proposedBy, principal),
     };
 }
 /**
  * New versions of build files that wait for an approval. Whoever may only
- * propose a version (`propose` on an entitlement) puts one here; someone who may
- * `publish` that name approves it, and it is published then.
+ * propose a version (`builds: propose`), or publishes one that names accounts they
+ * do not use, puts one here; someone who may publish, and uses those accounts,
+ * approves it, and it is published then.
  *
  *   GET  /v1/proposals                          the ones the caller proposed or may decide
  *   GET  /v1/proposals/<name>/<hash>            one of them
@@ -40,7 +52,7 @@ async function handleProposals(config, store, proposals, log, principal, req, re
     const [, name, hash, action] = match;
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
     // what the caller neither proposed nor may decide does not exist for them
-    const visible = (proposal) => same(proposal.proposedBy, principal) || (0, policy_1.mayPublish)(grant, proposal.name);
+    const visible = (proposal) => same(proposal.proposedBy, principal) || (0, policy_1.mayPublish)(grant);
     if (name === undefined) {
         if (req.method !== 'GET') {
             (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
@@ -91,8 +103,13 @@ async function handleProposals(config, store, proposals, log, principal, req, re
     }
     const outcome = action === 'approve' ? 'approved' : 'rejected';
     try {
-        const result = await proposals.decide(principal, name, hash, outcome, (n) => (0, policy_1.mayPublish)(grant, n), async (bundle) => {
+        const result = await proposals.decide(principal, name, hash, outcome, (proposed) => (0, exports.mayApprove)(grant, proposed), async (bundle) => {
             const proposed = proposals.get(name, hash);
+            // looked at again here, just before it is published
+            const latest = store.find(name, 'latest')?.hash ?? null;
+            if (proposed && latest !== proposed.base) {
+                throw new proposals_1.StaleProposalError(proposed.base, latest);
+            }
             await store.publish(name, bundle, proposed?.proposedBy ?? principal, principal);
         }, body.data.reason);
         log(`${action} proposal=${name}@${hash} iss=${principal.iss} sub=${principal.sub} result=${result.status}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
@@ -111,6 +128,11 @@ async function handleProposals(config, store, proposals, log, principal, req, re
         }
     }
     catch (e) {
+        if (e instanceof proposals_1.StaleProposalError) {
+            log(`${action} proposal=${name}@${hash} iss=${principal.iss} sub=${principal.sub} result=stale`);
+            (0, http_1.send)(res, 409, { error: e.message });
+            return true;
+        }
         if (e instanceof definitions_1.DefinitionError) {
             (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
             return true;