hammerkit 1.26.0 → 1.27.0-next.2

package/dist/server/oauth.js

@@ -106,6 +106,7 @@ class TokenVerifier {
                     ? [groups]
                     : [],
             claims,
+            ...(typeof payload.email_verified === 'boolean' ? { emailVerified: payload.email_verified } : {}),
         };
     }
     async findKey(issuer, algorithm, kid) {

package/dist/server/plan.js

@@ -12,8 +12,11 @@ const reference_parser_1 = require("../schema/reference-parser");
 const work_scope_parser_1 = require("../schema/work-scope-parser");
 const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
+const hosted_volumes_1 = require("../planner/utils/hosted-volumes");
 const log_1 = require("../log");
 const parse_error_1 = require("../schema/parse-error");
+const task_arguments_1 = require("../planner/utils/task-arguments");
+const work_network_1 = require("../planner/work-network");
 class DefinitionError extends Error {
 }
 exports.DefinitionError = DefinitionError;
@@ -155,6 +158,27 @@ function findPolicyProblems(items, policy, root) {
             problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
         }
         const data = item.data;
+        // what a task reads and writes is the bundle's: `src: ../..` would have the server
+        // copy its own files (its credentials, other callers' caches) into the task
+        for (const source of 'src' in data ? data.src : []) {
+            if (!source.inherited && insideBundle(root, data.cwd, source.absolutePath).length === 0) {
+                problems.push(`${item.name}: src ${source.source} is outside of the bundle`);
+            }
+        }
+        for (const generate of (0, work_task_1.isWorkTask)(data) ? data.generates : []) {
+            if (!generate.inherited && insideBundle(root, data.cwd, generate.path).length === 0) {
+                problems.push(`${item.name}: generates ${generate.path}, which is outside of the bundle`);
+            }
+        }
+        const ceiling = policy.network;
+        if (ceiling && (0, work_network_1.isLimitedNetwork)(ceiling)) {
+            if (data.type === 'local-task') {
+                problems.push(`${item.name}: is a local task, which can't be limited to the network this server allows (runs.network: ${(0, work_network_1.formatNetwork)(ceiling)})`);
+            }
+            else if ('network' in data && (0, work_network_1.exceedsNetwork)(data.network, ceiling)) {
+                problems.push(`${item.name}: asks for network ${(0, work_network_1.formatNetwork)(data.network)}, more than this server allows (runs.network: ${(0, work_network_1.formatNetwork)(ceiling)})`);
+            }
+        }
         if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
             for (const mount of data.mounts) {
                 // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
@@ -163,8 +187,31 @@ function findPolicyProblems(items, policy, root) {
                 }
             }
         }
+        for (const volume of (0, work_service_1.isContainerWorkService)(data) ? data.volumes : []) {
+            // docker takes anything else for a path of the host, such as the docker socket
+            if (!(0, hosted_volumes_1.isVolumeName)(volume.name)) {
+                problems.push(`${item.name}: volume ${volume.name} is not a volume name, a path of the server can't be mounted`);
+            }
+        }
         for (const secret of secretsOf(item)) {
             const source = secret.source;
+            if (policy.backend === 'kubernetes' && source.type === 'provider') {
+                // the server reads no secret of a provider on a cluster: the Job of a task does
+                if (!(0, work_task_1.isWorkTask)(item.data)) {
+                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider}, which ` +
+                        'this server does for tasks only, a service on its cluster gets no provider secret yet');
+                }
+                else if (secret.cache) {
+                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} has cache: true, its digest would need ` +
+                        'the value before the Job of the task reads it, which this server does not support yet');
+                }
+                else if (item.data.network.type !== 'open') {
+                    // the init containers that read it share the pod's NetworkPolicy
+                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider} in the ` +
+                        `Job of the task, which network ${(0, work_network_1.formatNetwork)(item.data.network)} would cut off from it, ` +
+                        'a task that reads secrets of a provider keeps an open network on this server');
+                }
+            }
             if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
                 problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
             }
@@ -172,7 +219,7 @@ function findPolicyProblems(items, policy, root) {
                 problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
             }
             else if (source.type === 'env' && !policy.envs.includes(source.name)) {
-                problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in runs.env.allow`);
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in ${policy.envsFrom ?? 'runs.env.allow'}`);
             }
         }
     }
@@ -205,10 +252,13 @@ function toPlan(root, item) {
         runtime: data.type === 'local-task' ? 'local' : 'docker',
         ...((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data) ? { image: data.image } : {}),
         cmds: 'cmds' in data ? data.cmds.map((cmd) => cmd.cmd) : 'cmd' in data && data.cmd ? [data.cmd.cmd] : [],
+        command: (0, task_arguments_1.getArgumentsTarget)(data)?.cmd ?? null,
+        network: (0, work_network_1.toNetworkSchema)('network' in data ? data.network : { type: 'open' }),
         deps: item.deps.map((dep) => dep.name).sort(),
         needs: item.needs.map((need) => need.name).sort(),
         accounts,
         secrets,
+        serverEnvs: 'envs' in data ? data.envs.processNames ?? [] : [],
         mounts,
         ports,
         generates: 'generates' in data ? data.generates.map((generate) => generate.path) : [],

package/dist/server/policy.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decideRun = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayRun = exports.matches = void 0;
+exports.decideRun = exports.sandboxRepos = exports.decideSandbox = exports.sandboxPushBranches = exports.sandboxBranchType = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayRun = exports.matches = void 0;
 const repo_1 = require("./repo");
 const BUILDS_ORDER = ['run', 'propose', 'publish'];
 function matches(entitlement, principal) {
@@ -54,6 +54,7 @@ function getGrant(entitlements, principal) {
     const matched = [];
     const accounts = {};
     const repos = [];
+    const sandboxes = [];
     let builds = null;
     entitlements.forEach((entitlement, index) => {
         if (!matches(entitlement, principal)) {
@@ -74,10 +75,99 @@ function getGrant(entitlements, principal) {
             (builds === null || BUILDS_ORDER.indexOf(entitlement.builds) > BUILDS_ORDER.indexOf(builds))) {
             builds = entitlement.builds;
         }
+        for (const sandbox of entitlement.sandboxes ?? []) {
+            let known = sandboxes.find((entry) => entry.repo === sandbox.repo);
+            if (!known) {
+                known = { repo: sandbox.repo, branches: {} };
+                sandboxes.push(known);
+            }
+            for (const [pattern, type] of Object.entries(sandbox.branches)) {
+                known.branches[pattern] = higherType(known.branches[pattern], type);
+            }
+        }
     });
-    return { accounts, repos, builds, matched };
+    return { accounts, repos, builds, sandboxes, matched };
 }
 exports.getGrant = getGrant;
+const BRANCH_TYPES = ['pull', 'push'];
+function higherType(a, b) {
+    return a !== undefined && BRANCH_TYPES.indexOf(a) > BRANCH_TYPES.indexOf(b) ? a : b;
+}
+// What the caller may do with a branch of a repository in a sandbox: the higher type of the
+// branch patterns that match it, in the entries whose `repo` covers the repository. The
+// branches of an entry never count for another repository. Null for nothing.
+function sandboxBranchType(grant, repo, branch) {
+    let found = null;
+    for (const sandbox of grant.sandboxes) {
+        if (!(0, repo_1.matchesRepo)(sandbox.repo, repo)) {
+            continue;
+        }
+        for (const [pattern, type] of Object.entries(sandbox.branches)) {
+            if ((0, repo_1.matchesRef)([pattern], branch)) {
+                found = higherType(found ?? undefined, type);
+            }
+        }
+    }
+    return found;
+}
+exports.sandboxBranchType = sandboxBranchType;
+// The branch patterns the caller may push to from a sandbox of a repository: those of type
+// `push` in the entries of their `sandboxes` that cover the repository. A pattern of one
+// repository never applies to another.
+function sandboxPushBranches(grant, repo) {
+    const branches = grant.sandboxes
+        .filter((sandbox) => (0, repo_1.matchesRepo)(sandbox.repo, repo))
+        .flatMap((sandbox) => Object.entries(sandbox.branches))
+        .filter(([, type]) => type === 'push')
+        .map(([pattern]) => pattern);
+    return [...new Set(branches)];
+}
+exports.sandboxPushBranches = sandboxPushBranches;
+// Whether the caller may start a sandbox of a repository from a branch, or fetch a branch
+// into one: a `pull` or `push` type for the branch in an entry of their `sandboxes` that
+// covers the repository, and the server able to read it. The answer is the reason when not.
+function decideSandbox(grant, repo, branch, readable) {
+    if (grant.sandboxes.length === 0) {
+        return { status: 403, error: 'you are not entitled to keep sandboxes on this server' };
+    }
+    return checkSandbox(grant, repo, branch, readable, 'keep a sandbox of');
+}
+exports.decideSandbox = decideSandbox;
+function checkSandbox(grant, repo, branch, readable, what) {
+    const repoProblem = checkRepo(sandboxRepos(grant), repo, readable, what);
+    if (repoProblem) {
+        return repoProblem;
+    }
+    if (sandboxBranchType(grant, repo, branch) === null) {
+        const branches = grant.sandboxes
+            .filter((sandbox) => (0, repo_1.matchesRepo)(sandbox.repo, repo))
+            .flatMap((sandbox) => Object.keys(sandbox.branches));
+        return {
+            status: 403,
+            error: `you may not ${what} ${repo} from ${branch}, your branches of it are ${[...new Set(branches)].join(', ')}`,
+        };
+    }
+    return null;
+}
+function sandboxRepos(grant) {
+    return grant.sandboxes.map((sandbox) => sandbox.repo);
+}
+exports.sandboxRepos = sandboxRepos;
+// the caller's own list first: what they may not name is not told whether the server can read it
+function checkRepo(repos, repo, readable, what) {
+    if (!(0, repo_1.matchesAnyRepo)(repos, repo)) {
+        return {
+            status: 403,
+            error: repos.length > 0
+                ? `you may not ${what} ${repo}, your repositories are ${repos.join(', ')}`
+                : `you may not ${what} ${repo}, no entitlement of yours lists a repository`,
+        };
+    }
+    if (!readable(repo)) {
+        return { status: 400, error: `this server can not read ${repo}` };
+    }
+    return null;
+}
 const COMMIT = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
 // The single place that decides what happens to a run that was submitted: it
 // starts, waits for an approval, or is refused with the reason.
@@ -93,18 +183,15 @@ function decideRun(input) {
             error: 'runs from an upload are not supported by this server yet, use a git ref',
         };
     }
-    // the caller's own list first: what they may not name is not told whether the server can read it
-    if (!(0, repo_1.matchesAnyRepo)(grant.repos, source.repo)) {
-        return {
-            type: 'refuse',
-            status: 403,
-            error: grant.repos.length > 0
-                ? `you may not run from ${source.repo}, your repositories are ${grant.repos.join(', ')}`
-                : `you may not run from ${source.repo}, no entitlement of yours lists a repository`,
-        };
+    if (source.type === 'sandbox' && grant.sandboxes.length === 0) {
+        return { type: 'refuse', status: 403, error: 'you are not entitled to keep sandboxes on this server' };
     }
-    if (!readable(source.repo)) {
-        return { type: 'refuse', status: 400, error: `this server can not read ${source.repo}` };
+    // runs on a sandbox: the repositories and branches in the `sandboxes` of the entitlements
+    const repoProblem = source.type === 'sandbox'
+        ? checkSandbox(grant, source.repo, source.branch, readable, 'run on a sandbox of')
+        : checkRepo(grant.repos, source.repo, readable, 'run from');
+    if (repoProblem) {
+        return { type: 'refuse', ...repoProblem };
     }
     const request = [];
     for (const account of accounts) {
@@ -113,10 +200,12 @@ function decideRun(input) {
             return { type: 'refuse', status: 403, error: `you may not use the account ${account}, it needs use or request` };
         }
         const rules = catalog[account];
-        if (rules?.source && !rules.source.includes(source.type)) {
+        // a sandbox holds changes nobody reviewed: an account takes its runs only when it says so
+        const sources = rules?.source ?? ['ref', 'upload'];
+        if (!sources.includes(source.type)) {
             return { type: 'refuse', status: 403, error: `the account ${account} is not used by runs from ${source.type}` };
         }
-        if (rules?.refs) {
+        if (rules?.refs && source.type === 'ref') {
             if (COMMIT.test(source.ref) || !(0, repo_1.matchesRef)(rules.refs, source.ref)) {
                 return {
                     type: 'refuse',

package/dist/server/proposals-api.js

@@ -7,29 +7,20 @@ const definitions_1 = require("./definitions");
 const http_1 = require("./http");
 const oauth_1 = require("./oauth");
 const policy_1 = require("./policy");
-const proposals_1 = require("./proposals");
-const server_config_1 = require("./server-config");
 const decisionSchema = zod_1.z.object({ reason: zod_1.z.string().max(500).optional() }).strict();
 const same = (a, b) => a.iss === b.iss && a.sub === b.sub;
 // Whoever approves publishes it, and uses the accounts its proposer did not: a
 // version that names an account is approved by somebody the account trusts.
 const mayApprove = (grant, proposal) => (0, policy_1.mayPublish)(grant) && proposal.missing.every((account) => (0, policy_1.canUse)(grant, account));
 exports.mayApprove = mayApprove;
-// What the caller is shown of a proposal: what it is, who proposed it and the
-// version it would replace, so the files can be compared.
-function toView(store, proposal, principal, grant) {
-    const latest = store.find(proposal.name, 'latest')?.hash ?? null;
-    const stale = proposal.state === 'waiting' && latest !== proposal.base;
+// What the caller is shown of a proposal: what it is and who proposed it.
+function toView(proposal, principal, grant) {
     return {
         ...proposal,
-        // the version it follows is fixed when it is proposed; if another one was
-        // published since, it can only be rejected
-        latest,
-        stale,
         mine: same(proposal.proposedBy, principal),
         // approving needs the permission to publish, the accounts the proposer lacked, and
         // somebody else's proposal
-        canDecide: proposal.state === 'waiting' && !stale && (0, exports.mayApprove)(grant, proposal) && !same(proposal.proposedBy, principal),
+        canDecide: proposal.state === 'waiting' && (0, exports.mayApprove)(grant, proposal) && !same(proposal.proposedBy, principal),
     };
 }
 /**
@@ -38,22 +29,22 @@ function toView(store, proposal, principal, grant) {
  * do not use, puts one here; someone who may publish, and uses those accounts,
  * approves it, and it is published then.
  *
- *   GET  /v1/proposals                          the ones the caller proposed or may decide
- *   GET  /v1/proposals/<name>/<hash>            one of them
- *   GET  /v1/proposals/<name>/<hash>/files      its files, for who decides
- *   POST /v1/proposals/<name>/<hash>/approve    publish it (body: optional {reason})
- *   POST /v1/proposals/<name>/<hash>/reject     drop it
+ *   GET  /v1/proposals                   the ones the caller proposed or may decide
+ *   GET  /v1/proposals/<hash>            one of them
+ *   GET  /v1/proposals/<hash>/files      its files, for who decides
+ *   POST /v1/proposals/<hash>/approve    publish it (body: optional {reason})
+ *   POST /v1/proposals/<hash>/reject     drop it
  */
 async function handleProposals(config, store, proposals, log, principal, req, res, url) {
-    const match = /^\/v1\/proposals(?:\/([^/]+)\/([^/]+)(?:\/(files|approve|reject))?)?$/.exec(url.pathname);
+    const match = /^\/v1\/proposals(?:\/([^/]+)(?:\/(files|approve|reject))?)?$/.exec(url.pathname);
     if (!match) {
         return false;
     }
-    const [, name, hash, action] = match;
+    const [, hash, action] = match;
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
     // what the caller neither proposed nor may decide does not exist for them
     const visible = (proposal) => same(proposal.proposedBy, principal) || (0, policy_1.mayPublish)(grant);
-    if (name === undefined) {
+    if (hash === undefined) {
         if (req.method !== 'GET') {
             (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
             return true;
@@ -62,22 +53,22 @@ async function handleProposals(config, store, proposals, log, principal, req, re
             proposals: proposals
                 .all()
                 .filter(visible)
-                .map((proposal) => toView(store, proposal, principal, grant)),
+                .map((proposal) => toView(proposal, principal, grant)),
         });
         return true;
     }
-    if (!server_config_1.definitionName.safeParse(name).success || !bundle_1.HASH_PATTERN.test(hash)) {
+    if (!bundle_1.HASH_PATTERN.test(hash)) {
         (0, http_1.send)(res, 404, { error: 'not found' });
         return true;
     }
-    const proposal = proposals.get(name, hash);
+    const proposal = proposals.get(hash);
     if (!action) {
         if (req.method !== 'GET') {
             (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
             return true;
         }
         proposal && visible(proposal)
-            ? (0, http_1.send)(res, 200, toView(store, proposal, principal, grant))
+            ? (0, http_1.send)(res, 200, toView(proposal, principal, grant))
             : (0, http_1.send)(res, 404, { error: 'not found' });
         return true;
     }
@@ -87,7 +78,7 @@ async function handleProposals(config, store, proposals, log, principal, req, re
             return true;
         }
         // the files are for who decides, and for who wrote them
-        const bundle = proposal && visible(proposal) ? proposals.bundle(name, hash) : undefined;
+        const bundle = proposal && visible(proposal) ? proposals.bundle(hash) : undefined;
         bundle ? (0, http_1.send)(res, 200, bundle) : (0, http_1.send)(res, 404, { error: 'not found' });
         return true;
     }
@@ -103,19 +94,17 @@ async function handleProposals(config, store, proposals, log, principal, req, re
     }
     const outcome = action === 'approve' ? 'approved' : 'rejected';
     try {
-        const result = await proposals.decide(principal, name, hash, outcome, (proposed) => (0, exports.mayApprove)(grant, proposed), async (bundle) => {
-            const proposed = proposals.get(name, hash);
-            // looked at again here, just before it is published
-            const latest = store.find(name, 'latest')?.hash ?? null;
-            if (proposed && latest !== proposed.base) {
-                throw new proposals_1.StaleProposalError(proposed.base, latest);
-            }
-            await store.publish(name, bundle, proposed?.proposedBy ?? principal, principal);
+        const result = await proposals.decide(principal, hash, outcome, (proposed) => (0, exports.mayApprove)(grant, proposed), async (bundle) => {
+            const proposed = proposals.get(hash);
+            await store.publish(bundle, proposed?.proposedBy ?? principal, {
+                approvedBy: principal,
+                annotations: proposed?.annotations,
+            });
         }, body.data.reason);
-        log(`${action} proposal=${name}@${hash} iss=${principal.iss} sub=${principal.sub} result=${result.status}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
+        log(`${action} proposal=${hash} iss=${principal.iss} sub=${principal.sub} result=${result.status}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
         switch (result.status) {
             case 'ok':
-                (0, http_1.send)(res, 200, toView(store, result.proposal, principal, grant));
+                (0, http_1.send)(res, 200, toView(result.proposal, principal, grant));
                 break;
             case 'own-proposal':
                 (0, http_1.send)(res, 403, { error: 'a version is approved by somebody else than who proposed it' });
@@ -128,11 +117,6 @@ async function handleProposals(config, store, proposals, log, principal, req, re
         }
     }
     catch (e) {
-        if (e instanceof proposals_1.StaleProposalError) {
-            log(`${action} proposal=${name}@${hash} iss=${principal.iss} sub=${principal.sub} result=stale`);
-            (0, http_1.send)(res, 409, { error: e.message });
-            return true;
-        }
         if (e instanceof definitions_1.DefinitionError) {
             (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
             return true;

package/dist/server/proposals.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProposalRegistry = exports.StaleProposalError = exports.CooldownError = exports.ProposalError = void 0;
+exports.ProposalRegistry = exports.CooldownError = exports.ProposalError = void 0;
 const units_1 = require("../utils/units");
 class ProposalError extends Error {
     constructor() {
@@ -18,15 +18,6 @@ class CooldownError extends ProposalError {
     }
 }
 exports.CooldownError = CooldownError;
-// The build file moved on since the proposal was made
-class StaleProposalError extends Error {
-    constructor(base, latest) {
-        super(`the build file changed since this was proposed (it follows ${base ?? 'nothing'}, the latest is ${latest ?? 'nothing'}), propose it again on top of the latest`);
-        this.base = base;
-        this.latest = latest;
-    }
-}
-exports.StaleProposalError = StaleProposalError;
 // The proposals of the server, in memory: a restart forgets what waits, and
 // whoever proposed it proposes it again. Nothing in here is runnable.
 class ProposalRegistry {
@@ -40,11 +31,11 @@ class ProposalRegistry {
         this.now = options.now ?? Date.now;
     }
     // Proposing what already waits is not an error and changes nothing.
-    propose(version, bundle, proposer, missing = [], base = null) {
+    propose(version, bundle, proposer, missing = []) {
         if (this.closed) {
             throw new ProposalError('the server is shutting down');
         }
-        const key = this.key(version.name, version.hash);
+        const key = version.hash;
         const existing = this.entries.get(key);
         if (existing && existing.proposal.state === 'waiting') {
             return { proposal: { ...existing.proposal }, created: false };
@@ -54,7 +45,6 @@ class ProposalRegistry {
             throw new ProposalError('too many build file versions are waiting for an approval');
         }
         const proposal = {
-            name: version.name,
             hash: version.hash,
             entry: version.entry,
             tasks: version.tasks,
@@ -62,7 +52,7 @@ class ProposalRegistry {
             accounts: version.accounts ?? [],
             missing,
             plan: version.plan ?? {},
-            base,
+            ...(version.annotations ? { annotations: { ...version.annotations } } : {}),
             proposedBy: { iss: proposer.iss, sub: proposer.sub },
             createdAt: new Date(this.now()).toISOString(),
             expiresAt: new Date(this.now() + this.timeout).toISOString(),
@@ -83,19 +73,19 @@ class ProposalRegistry {
     all() {
         return [...this.entries.values()].map((e) => ({ ...e.proposal })).reverse();
     }
-    get(name, hash) {
-        const entry = this.entries.get(this.key(name, hash));
+    get(hash) {
+        const entry = this.entries.get(hash);
         return entry ? { ...entry.proposal } : undefined;
     }
     // The files of one that still waits, for whoever decides on it.
-    bundle(name, hash) {
-        return this.entries.get(this.key(name, hash))?.bundle;
+    bundle(hash) {
+        return this.entries.get(hash)?.bundle;
     }
     // An approval publishes the files first (`publish`), and only then is the
     // proposal approved, so it never claims a version that is not there. Nobody
     // decides on their own proposal.
-    async decide(decider, name, hash, outcome, mayDecide, publish, reason) {
-        const entry = this.entries.get(this.key(name, hash));
+    async decide(decider, hash, outcome, mayDecide, publish, reason) {
+        const entry = this.entries.get(hash);
         if (!entry || !mayDecide(entry.proposal)) {
             return { status: 'not-found' };
         }
@@ -147,14 +137,14 @@ class ProposalRegistry {
             return;
         }
         for (const { proposal } of this.entries.values()) {
-            if (proposal.state !== 'rejected' || proposal.name !== version.name) {
+            if (proposal.state !== 'rejected') {
                 continue;
             }
             const left = Date.parse(proposal.decidedAt ?? '') + this.cooldown - this.now();
             const sameVersion = proposal.hash === version.hash;
             const sameProposer = proposal.proposedBy.iss === proposer.iss && proposal.proposedBy.sub === proposer.sub;
             if (left > 0 && (sameVersion || sameProposer)) {
-                throw new CooldownError(`${sameVersion ? 'this version was' : 'a version of this build file by you was'} rejected, ` +
+                throw new CooldownError(`${sameVersion ? 'this version was' : 'a version you proposed was'} rejected, ` +
                     `propose again in ${(0, units_1.formatDuration)(Math.ceil(left / 1000) * 1000)}`);
             }
         }
@@ -165,9 +155,6 @@ class ProposalRegistry {
             this.entries.delete(key);
         }
     }
-    key(name, hash) {
-        return `${name}@${hash}`;
-    }
 }
 exports.ProposalRegistry = ProposalRegistry;
 //# sourceMappingURL=proposals.js.map

package/dist/server/repo-access.js

@@ -40,16 +40,17 @@ class RepoAccess {
     url(repo) {
         return this.options.url ? this.options.url(repo) : `https://${repo}.git`;
     }
-    // The commit a ref points to now, or an error that says what is wrong with the ref.
-    async resolve(repo, ref, signal) {
+    // The commit a ref points to now, or an error that says what is wrong with the ref. With
+    // `branch`, only a branch.
+    async resolve(repo, ref, signal, only) {
         const timeout = AbortSignal.timeout(RESOLVE_TIMEOUT_MS);
         const abort = signal ? AbortSignal.any([signal, timeout]) : timeout;
         if (this.options.resolve) {
-            return this.options.resolve(repo, ref, abort);
+            return this.options.resolve(repo, ref, abort, only);
         }
         const credentials = await this.credentials(repo);
         try {
-            return await (0, git_checkout_1.resolveRef)(this.url(repo), ref, credentials.env, abort);
+            return await (0, git_checkout_1.resolveRef)(this.url(repo), ref, credentials.env, abort, only);
         }
         catch (e) {
             throw this.scrub(e, credentials.values);
@@ -79,6 +80,31 @@ class RepoAccess {
         env.GIT_CONFIG_VALUE_0 = header;
         return { env, values: [token, header] };
     }
+    /**
+     * The same for pushing a sandbox to the repository, with the source's `secret`. A
+     * repository the server reads without one is not pushed to: a push never falls back to
+     * a credential git finds on the server.
+     */
+    async pushCredentials(repo) {
+        if (!this.source(repo)?.secret) {
+            throw new Error(`this server does not push to ${repo}`);
+        }
+        const credentials = await this.credentials(repo);
+        // nothing but that token: no configuration, credential helper, .netrc or ssh agent of
+        // the server's user, which would push as whoever that user is
+        const env = { ...credentials.env };
+        for (const key of ['HOME', 'XDG_CONFIG_HOME', 'SSH_AUTH_SOCK', 'GIT_ASKPASS', 'SSH_ASKPASS', 'GIT_SSH_COMMAND']) {
+            delete env[key];
+        }
+        const count = Number(env.GIT_CONFIG_COUNT ?? '0');
+        env[`GIT_CONFIG_KEY_${count}`] = 'credential.helper';
+        env[`GIT_CONFIG_VALUE_${count}`] = '';
+        env.GIT_CONFIG_COUNT = String(count + 1);
+        env.GIT_CONFIG_NOSYSTEM = '1';
+        // an empty file on every platform: git for Windows opens `/dev/null` as `nul`
+        env.GIT_CONFIG_GLOBAL = '/dev/null';
+        return { env, values: credentials.values };
+    }
     async token(secret) {
         const key = `${secret.account}\0${secret.from}`;
         const known = this.tokens.get(key);
@@ -118,8 +144,13 @@ class RepoAccess {
     scrub(error, values) {
         const registry = (0, redact_1.createSecretRegistry)();
         values.forEach((value) => registry.register(value));
-        const message = error instanceof Error ? error.message : String(error);
-        const scrubbed = new (error instanceof Error ? error.constructor : Error)(registry.redact(message));
+        const scrubbed = new Error(registry.redact(error instanceof Error ? error.message : String(error)));
+        if (error instanceof Error) {
+            // its class, so a caller still tells a RefError apart, but none of its fields: a
+            // constructor may take more than the message (SandboxPushFailed), a field may hold the token
+            Object.setPrototypeOf(scrubbed, Object.getPrototypeOf(error));
+            scrubbed.name = error.name;
+        }
         return scrubbed;
     }
 }