hammerkit 1.27.0-next.2 → 1.27.0-next.20

package/dist/server/kubernetes-sandbox-storage.js

@@ -7,9 +7,11 @@ const path_1 = require("path");
 const stream_1 = require("stream");
 const promises_2 = require("stream/promises");
 const tar_1 = require("tar");
+const tar_2 = require("../utils/tar");
 const apply_1 = require("../kubernetes/apply");
 const kubernetes_instance_1 = require("../kubernetes/kubernetes-instance");
 const network_policy_1 = require("../kubernetes/network-policy");
+const sandbox_runner_1 = require("../kubernetes/sandbox-runner");
 const volumes_1 = require("../kubernetes/volumes");
 const log_1 = require("../log");
 const sleep_1 = require("../utils/sleep");
@@ -259,6 +261,41 @@ class KubernetesSandboxStorage {
             await (0, promises_1.rm)(repository, { recursive: true, force: true });
         }
     }
+    // The pod writes the tree's files beside the sandbox on the claim and sends them as a tar,
+    // which is extracted here as the files of `attach` are: what a run plans with, up to the
+    // bytes a sandbox may take.
+    async exportTree(key, tree, into, signal) {
+        await (0, promises_1.mkdir)(into, { recursive: true });
+        let bytes = 0;
+        const extract = (0, tar_1.extract)({
+            cwd: into,
+            filter: (_path, entry) => 'type' in entry && ['File', 'OldFile', 'Directory', 'SymbolicLink'].includes(entry.type),
+        });
+        const counted = new stream_1.PassThrough();
+        counted.on('data', (chunk) => {
+            bytes += chunk.length;
+            if (bytes > this.limits.bytes) {
+                counted.destroy(new Error(`the files of the sandbox ${key.id} take more than ${(0, units_1.formatSize)(this.limits.bytes)}`));
+            }
+        });
+        const extracted = new Promise((resolve, reject) => {
+            extract.on('finish', resolve);
+            extract.on('error', reject);
+            counted.on('error', reject);
+        });
+        extracted.catch(() => undefined);
+        counted.pipe(extract);
+        const answer = await this.exclusive(key.id, () => this.call(key, { op: 'archive', id: key.id, tree }, signal, true));
+        if ('stream' in answer) {
+            // a pipeline, so the answer is ended with the copy: an error of the pod after the copy
+            // stopped (over the size limit) lands nowhere else
+            await (0, promises_2.pipeline)(answer.stream, counted);
+        }
+        else {
+            counted.end(answer.body);
+        }
+        await extracted;
+    }
     async moveTo(key, commit) {
         await this.request(key, { op: 'move', id: key.id, commit }, AbortSignal.timeout(FETCH_TIMEOUT_MS));
     }
@@ -283,6 +320,8 @@ class KubernetesSandboxStorage {
             // runs on a sandbox go one at a time: a proxy the pod of the files does not own was
             // left by a run before (the server stopped, or its release could not remove it)
             await (0, network_policy_1.removeSandboxProxies)(this.instance, namespace, { sandbox: names.label }, (deployment) => isOwnedBy(deployment, pod.uid)).catch(() => undefined);
+            // and a runner, which the pod did not own when it made way for a run
+            await (0, sandbox_runner_1.removeSandboxRunners)(this.instance, namespace, names.label, (runner) => isOwnedBy(runner, pod.uid)).catch(() => undefined);
             await (0, promises_1.mkdir)(into, { recursive: true });
             await this.copyOut(key, ['tar', 'cf', '-', '-C', `${CLAIM_PATH}/${key.id}/files`, '.'], into, 
             // what the run plans with: files, directories and links, nothing outside of it
@@ -387,7 +426,8 @@ class KubernetesSandboxStorage {
     async removeIn(namespace, id) {
         const names = getSandboxNames(id);
         await this.stopPod({ id, owner: { iss: '', sub: '' } }, namespace);
-        // the cluster removes the proxies the pod owned; those it did not own go here
+        // the cluster removes the proxies and the runner the pod owned; those it did not own go here
+        await (0, sandbox_runner_1.removeSandboxRunners)(this.instance, namespace, names.label);
         await (0, network_policy_1.removeSandboxProxies)(this.instance, namespace, { sandbox: names.label });
         for (const name of [names.claim, names.git]) {
             try {
@@ -463,7 +503,7 @@ class KubernetesSandboxStorage {
             await (0, git_checkout_1.git)([`--git-dir=${repository}`, 'fetch', '--quiet', '--depth', '1', '--', fetch.url, fetch.ref], fetch.env, fetch.signal, what);
             await (0, git_checkout_1.git)([`--git-dir=${repository}`, 'update-ref', `refs/heads/${sandbox_pod_1.INCOMING_REF}`, 'FETCH_HEAD'], fetch.env, fetch.signal, what, op);
             const incoming = `${CLAIM_PATH}/${sandbox_pod_1.INCOMING}`;
-            await this.withPod(key, (pod) => this.exec(pod, ['sh', '-c', 'rm -rf "$1" && mkdir -p "$1" && tar xf - -C "$1"', 'sh', incoming], stream_1.Readable.from((0, tar_1.create)({ cwd: repository, portable: true }, ['.'])), null, fetch.signal));
+            await this.withPod(key, (pod) => this.exec(pod, ['sh', '-c', 'rm -rf "$1" && mkdir -p "$1" && tar xf - -C "$1"', 'sh', incoming], stream_1.Readable.from((0, tar_2.packArchive)({ cwd: repository, portable: true }, ['.'])), null, fetch.signal));
             return (await this.request(key, { op, id: key.id }, fetch.signal)).result;
         }
         finally {
@@ -501,7 +541,7 @@ class KubernetesSandboxStorage {
         const reader = new AnswerReader(body);
         // the process ends when the server stops waiting for it: closing the connection does
         // not end a command in a pod
-        const seconds = Math.ceil((['create', 'fetch', 'move'].includes(request.op) ? FETCH_TIMEOUT_MS : REQUEST_TIMEOUT_MS) / 1000);
+        const seconds = Math.ceil((['create', 'fetch', 'move', 'archive'].includes(request.op) ? FETCH_TIMEOUT_MS : REQUEST_TIMEOUT_MS) / 1000);
         const done = this.withPod(key, (pod) => this.exec(pod, ['timeout', String(seconds), 'hammerkit', 'server-sandbox', CLAIM_PATH], stream_1.Readable.from([Buffer.from(JSON.stringify(encoded))]), reader, signal));
         done.then(() => reader.complete(), (e) => reader.fail(e));
         const answer = await reader.answer;
@@ -884,6 +924,11 @@ class AnswerReader extends stream_1.Writable {
     }
     _write(chunk, _encoding, callback) {
         if (this.stream) {
+            if (this.stream.destroyed) {
+                // its reader stopped (over a size limit): the rest of the answer is nobody's
+                callback();
+                return;
+            }
             this.stream.write(chunk, callback);
             return;
         }

package/dist/server/oauth.js

@@ -106,7 +106,7 @@ class TokenVerifier {
                     ? [groups]
                     : [],
             claims,
-            ...(typeof payload.email_verified === 'boolean' ? { emailVerified: payload.email_verified } : {}),
+            ...emailVerified(payload.email_verified),
         };
     }
     async findKey(issuer, algorithm, kid) {
@@ -224,4 +224,15 @@ function isSecureUrl(value) {
         return false;
     }
 }
+// Some issuers send `email_verified` as the string "true" or "false": either says it as
+// much as the boolean does, anything else says nothing
+function emailVerified(value) {
+    if (value === true || value === 'true') {
+        return { emailVerified: true };
+    }
+    if (value === false || value === 'false') {
+        return { emailVerified: false };
+    }
+    return {};
+}
 //# sourceMappingURL=oauth.js.map

package/dist/server/plan.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.inspectBundle = exports.planBundle = exports.DefinitionError = void 0;
+exports.inspectBundle = exports.planBundle = exports.getCredentialReads = exports.PLAIN_SERVER_ENVS = exports.DefinitionError = void 0;
 const promises_1 = require("fs/promises");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -13,6 +13,7 @@ const work_scope_parser_1 = require("../schema/work-scope-parser");
 const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
 const hosted_volumes_1 = require("../planner/utils/hosted-volumes");
+const normalize_path_1 = require("../planner/utils/normalize-path");
 const log_1 = require("../log");
 const parse_error_1 = require("../schema/parse-error");
 const task_arguments_1 = require("../planner/utils/task-arguments");
@@ -20,6 +21,20 @@ const work_network_1 = require("../planner/work-network");
 class DefinitionError extends Error {
 }
 exports.DefinitionError = DefinitionError;
+// Variables of a server that hold no credential (FR-008): a task may read these and
+// still take arguments, or reach any network.
+exports.PLAIN_SERVER_ENVS = ['PATH', 'HOME', 'CI'];
+// What an item holds that its command must not hand out: its secrets, and the variables
+// of the server its `envs` read, but the plain ones.
+function getCredentialReads(item) {
+    return [
+        ...item.secrets.map((secret) => `the secret ${secret.target}`),
+        ...(item.serverEnvs ?? [])
+            .filter((env) => !exports.PLAIN_SERVER_ENVS.includes(env.toUpperCase()))
+            .map((env) => `$${env} of the server`),
+    ];
+}
+exports.getCredentialReads = getCredentialReads;
 // 40 (sha-1) or 64 (sha-256) hex digits
 const COMMIT_PATTERN = /^[0-9a-f]{40}([0-9a-f]{24})?$/i;
 // A hash alone can only name what is inside the bundle, so everything a build
@@ -151,80 +166,127 @@ function describeSecret(secret) {
 // server has no account, so nothing would stand between the build file and the
 // operator's own credentials.
 function findPolicyProblems(items, policy, root) {
-    const problems = [];
+    // the problems of each item, said once for the items of a directory that share one, such
+    // as the tasks of an included file that all mount the docker socket
+    const grouped = new Map();
     for (const item of items) {
-        const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
-        if (policy.runtimes && !policy.runtimes.includes(runtime)) {
-            problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
-        }
-        const data = item.data;
-        // what a task reads and writes is the bundle's: `src: ../..` would have the server
-        // copy its own files (its credentials, other callers' caches) into the task
-        for (const source of 'src' in data ? data.src : []) {
-            if (!source.inherited && insideBundle(root, data.cwd, source.absolutePath).length === 0) {
-                problems.push(`${item.name}: src ${source.source} is outside of the bundle`);
+        const prefix = `${item.name}: `;
+        for (const problem of findItemPolicyProblems(item, policy, root)) {
+            const said = problem.startsWith(prefix) ? problem.slice(prefix.length) : problem;
+            const key = `${item.data.cwd}\0${said}`;
+            const group = grouped.get(key);
+            if (group) {
+                group.names.push(item.name);
             }
-        }
-        for (const generate of (0, work_task_1.isWorkTask)(data) ? data.generates : []) {
-            if (!generate.inherited && insideBundle(root, data.cwd, generate.path).length === 0) {
-                problems.push(`${item.name}: generates ${generate.path}, which is outside of the bundle`);
+            else {
+                grouped.set(key, { names: [item.name], problem: said });
             }
         }
-        const ceiling = policy.network;
-        if (ceiling && (0, work_network_1.isLimitedNetwork)(ceiling)) {
-            if (data.type === 'local-task') {
-                problems.push(`${item.name}: is a local task, which can't be limited to the network this server allows (runs.network: ${(0, work_network_1.formatNetwork)(ceiling)})`);
-            }
-            else if ('network' in data && (0, work_network_1.exceedsNetwork)(data.network, ceiling)) {
-                problems.push(`${item.name}: asks for network ${(0, work_network_1.formatNetwork)(data.network)}, more than this server allows (runs.network: ${(0, work_network_1.formatNetwork)(ceiling)})`);
-            }
+    }
+    return [...grouped.values()].map(({ names: [name, ...others], problem }) => others.length > 0 ? `${name} (also ${others.join(', ')}): ${problem}` : `${name}: ${problem}`);
+}
+function findItemPolicyProblems(item, policy, root) {
+    const problems = [];
+    const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
+    // an aggregate runs nothing, on no runtime
+    if (policy.runtimes && !(0, work_task_1.isAggregateTask)(item.data) && !policy.runtimes.includes(runtime)) {
+        problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
+    }
+    const data = item.data;
+    // what a task reads and writes is the bundle's: `src: ../..` would have the server
+    // copy its own files (its credentials, other callers' caches) into the task
+    for (const source of 'src' in data ? data.src : []) {
+        if (!source.inherited && insideBundle(root, data.cwd, source.absolutePath).length === 0) {
+            problems.push(`${item.name}: src ${source.source} is outside of the bundle`);
         }
-        if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
-            for (const mount of data.mounts) {
-                // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
-                if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
-                    problems.push(`${item.name}: mounts ${mount.localPath}, which is outside of the bundle`);
-                }
-            }
+    }
+    for (const generate of (0, work_task_1.isWorkTask)(data) ? data.generates : []) {
+        if (!generate.inherited && insideBundle(root, data.cwd, generate.path).length === 0) {
+            problems.push(`${item.name}: generates ${generate.path}, which is outside of the bundle`);
         }
-        for (const volume of (0, work_service_1.isContainerWorkService)(data) ? data.volumes : []) {
-            // docker takes anything else for a path of the host, such as the docker socket
-            if (!(0, hosted_volumes_1.isVolumeName)(volume.name)) {
-                problems.push(`${item.name}: volume ${volume.name} is not a volume name, a path of the server can't be mounted`);
-            }
+    }
+    // what holds a credential gets at most `runs.secretNetwork`, so a tool it runs can't
+    // send the credential anywhere else
+    const reads = getCredentialReads({
+        secrets: secretsOf(item).map(describeSecret),
+        serverEnvs: 'envs' in data ? data.envs.processNames ?? [] : [],
+    });
+    const ceilings = [];
+    if (policy.network && (0, work_network_1.isLimitedNetwork)(policy.network)) {
+        ceilings.push({ ceiling: policy.network, setting: 'runs.network', reason: '' });
+    }
+    if (reads.length > 0 && policy.secretNetwork && (0, work_network_1.isLimitedNetwork)(policy.secretNetwork)) {
+        ceilings.push({
+            ceiling: policy.secretNetwork,
+            setting: 'runs.secretNetwork',
+            reason: ` to what reads ${reads.join(', ')}`,
+        });
+    }
+    // an aggregate reaches nothing: it runs no command
+    for (const { ceiling, setting, reason } of (0, work_task_1.isAggregateTask)(data) ? [] : ceilings) {
+        // on a cluster a local task is a pod of a pool's tool image, limited like any other
+        if (data.type === 'local-task' && policy.backend !== 'kubernetes') {
+            problems.push(`${item.name}: is a local task, which can't be limited to the network this server allows${reason} ` +
+                `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
         }
-        for (const secret of secretsOf(item)) {
-            const source = secret.source;
-            if (policy.backend === 'kubernetes' && source.type === 'provider') {
-                // the server reads no secret of a provider on a cluster: the Job of a task does
-                if (!(0, work_task_1.isWorkTask)(item.data)) {
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider}, which ` +
-                        'this server does for tasks only, a service on its cluster gets no provider secret yet');
-                }
-                else if (secret.cache) {
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} has cache: true, its digest would need ` +
-                        'the value before the Job of the task reads it, which this server does not support yet');
-                }
-                else if (item.data.network.type !== 'open') {
-                    // the init containers that read it share the pod's NetworkPolicy
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider} in the ` +
-                        `Job of the task, which network ${(0, work_network_1.formatNetwork)(item.data.network)} would cut off from it, ` +
-                        'a task that reads secrets of a provider keeps an open network on this server');
-                }
+        else if ('network' in data && (0, work_network_1.exceedsNetwork)(data.network, ceiling)) {
+            problems.push(`${item.name}: asks for network ${(0, work_network_1.formatNetwork)(data.network)}, more than this server allows${reason} ` +
+                `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
+        }
+    }
+    if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
+        for (const mount of data.mounts) {
+            // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
+            if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
+                problems.push(`${item.name}: mounts ${describeMountSource(mount)}, which is outside of the bundle`);
             }
-            if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
-                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+        }
+    }
+    for (const volume of (0, work_service_1.isContainerWorkService)(data) ? data.volumes : []) {
+        // docker takes anything else for a path of the host, such as the docker socket
+        if (!(0, hosted_volumes_1.isVolumeName)(volume.name)) {
+            problems.push(`${item.name}: volume ${volume.name} is not a volume name, a path of the server can't be mounted`);
+        }
+    }
+    for (const secret of secretsOf(item)) {
+        const source = secret.source;
+        if (policy.backend === 'kubernetes' && source.type === 'provider') {
+            // the server reads no secret of a provider on a cluster: the Job of a task does
+            if (!(0, work_task_1.isWorkTask)(item.data)) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider}, which ` +
+                    'this server does for tasks only, a service on its cluster gets no provider secret yet');
             }
-            else if (source.type === 'file') {
-                problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+            else if (secret.cache) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} has cache: true, its digest would need ` +
+                    'the value before the Job of the task reads it, which this server does not support yet');
             }
-            else if (source.type === 'env' && !policy.envs.includes(source.name)) {
-                problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in ${policy.envsFrom ?? 'runs.env.allow'}`);
+            else if ((0, work_network_1.isLimitedNetwork)(item.data.network) && !policy.proxiedProviders?.includes(source.provider)) {
+                // the init containers that read it share the pod's NetworkPolicy, and reach the
+                // provider only through the egress proxy
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider} in the ` +
+                    `Job of the task, which network ${(0, work_network_1.formatNetwork)(item.data.network)} would cut off from it: ` +
+                    `this server names no endpoints of ${source.provider} in backend.providers.${source.provider}.allow ` +
+                    'for the egress proxy to let through, so the task keeps an open network');
             }
         }
+        if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
+            problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+        }
+        else if (source.type === 'file') {
+            problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+        }
+        else if (source.type === 'env' && !policy.envs.includes(source.name)) {
+            problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in ${policy.envsFrom ?? 'runs.env.allow'}`);
+        }
     }
     return problems;
 }
+// A mount of the home directory says so: `$PWD` in a mount is the home directory, not the
+// project, which reads like a path of the checkout
+function describeMountSource(mount) {
+    const home = (0, normalize_path_1.getHomeReference)(mount.mount.split(':')[0]);
+    return home ? `${mount.localPath} (${home} is the home directory)` : mount.localPath;
+}
 function toPlan(root, item) {
     const data = item.data;
     const secrets = secretsOf(item).map(describeSecret);
@@ -237,7 +299,7 @@ function toPlan(root, item) {
         : [];
     const ports = 'ports' in data ? data.ports.map((port) => `${port.hostPort ?? ''}:${port.containerPort}`) : [];
     const flags = [];
-    if (data.type === 'local-task') {
+    if (data.type === 'local-task' && !(0, work_task_1.isAggregateTask)(data)) {
         flags.push('local-task');
     }
     if ('ports' in data && data.ports.some((port) => port.hostPort !== null)) {
@@ -249,11 +311,13 @@ function toPlan(root, item) {
     const isTask = data.type === 'local-task' || data.type === 'container-task';
     return {
         kind: isTask ? 'task' : 'service',
-        runtime: data.type === 'local-task' ? 'local' : 'docker',
+        ...(data.description ? { description: data.description } : {}),
+        runtime: (0, work_task_1.isAggregateTask)(data) ? 'none' : data.type === 'local-task' ? 'local' : 'docker',
         ...((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data) ? { image: data.image } : {}),
         cmds: 'cmds' in data ? data.cmds.map((cmd) => cmd.cmd) : 'cmd' in data && data.cmd ? [data.cmd.cmd] : [],
         command: (0, task_arguments_1.getArgumentsTarget)(data)?.cmd ?? null,
         network: (0, work_network_1.toNetworkSchema)('network' in data ? data.network : { type: 'open' }),
+        ...('args' in data && data.args !== null ? { args: data.args } : {}),
         deps: item.deps.map((dep) => dep.name).sort(),
         needs: item.needs.map((need) => need.name).sort(),
         accounts,

package/dist/server/policy.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decideRun = exports.sandboxRepos = exports.decideSandbox = exports.sandboxPushBranches = exports.sandboxBranchType = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayRun = exports.matches = void 0;
+exports.decideRun = exports.sandboxRepos = exports.decideSandbox = exports.sandboxPushBranches = exports.sandboxBranchType = exports.endpointLevel = exports.getGrant = exports.usedAccounts = exports.mayYank = exports.canUse = exports.maySeeDefinitions = exports.mayPublish = exports.mayPropose = exports.mayReadChecks = exports.mayRun = exports.matches = void 0;
 const repo_1 = require("./repo");
 const BUILDS_ORDER = ['run', 'propose', 'publish'];
 function matches(entitlement, principal) {
@@ -22,6 +22,12 @@ function atLeast(grant, level) {
 }
 const mayRun = (grant) => atLeast(grant, 'run');
 exports.mayRun = mayRun;
+// Who may run from a repository's refs may see what passed for its files, and so may who
+// is entitled to just that (a CI job that only verifies).
+function mayReadChecks(grant, repo) {
+    return (grant.checks || grant.builds !== null) && (0, repo_1.matchesAnyRepo)(grant.repos, repo);
+}
+exports.mayReadChecks = mayReadChecks;
 const mayPropose = (grant) => atLeast(grant, 'propose');
 exports.mayPropose = mayPropose;
 const mayPublish = (grant) => atLeast(grant, 'publish');
@@ -55,12 +61,15 @@ function getGrant(entitlements, principal) {
     const accounts = {};
     const repos = [];
     const sandboxes = [];
+    const endpoints = [];
     let builds = null;
+    let checks = false;
     entitlements.forEach((entitlement, index) => {
         if (!matches(entitlement, principal)) {
             return;
         }
         matched.push(index);
+        checks = checks || entitlement.checks === 'read';
         for (const [account, level] of Object.entries(entitlement.accounts)) {
             if (accounts[account] !== 'use') {
                 accounts[account] = level;
@@ -85,10 +94,31 @@ function getGrant(entitlements, principal) {
                 known.branches[pattern] = higherType(known.branches[pattern], type);
             }
         }
+        for (const endpoint of entitlement.endpoints ?? []) {
+            const known = endpoints.find((entry) => entry.repo === endpoint.repo);
+            if (!known) {
+                endpoints.push({ ...endpoint });
+            }
+            else if (endpoint.level === 'publish') {
+                known.level = 'publish';
+            }
+        }
     });
-    return { accounts, repos, builds, sandboxes, matched };
+    return { accounts, repos, builds, sandboxes, endpoints, checks, matched };
 }
 exports.getGrant = getGrant;
+// What the caller may do with the endpoints of service runs of a repository: the higher
+// level of the entries whose `repo` covers it, null for nothing.
+function endpointLevel(grant, repo) {
+    let found = null;
+    for (const endpoint of grant.endpoints) {
+        if ((0, repo_1.matchesRepo)(endpoint.repo, repo) && found !== 'publish') {
+            found = endpoint.level;
+        }
+    }
+    return found;
+}
+exports.endpointLevel = endpointLevel;
 const BRANCH_TYPES = ['pull', 'push'];
 function higherType(a, b) {
     return a !== undefined && BRANCH_TYPES.indexOf(a) > BRANCH_TYPES.indexOf(b) ? a : b;

package/dist/server/repo-access.js

@@ -105,6 +105,11 @@ class RepoAccess {
         env.GIT_CONFIG_GLOBAL = '/dev/null';
         return { env, values: credentials.values };
     }
+    // A secret only the server reads, as an account no caller may use: the client secret of
+    // the sign-in at endpoints, read like the credential of a source.
+    serverSecret(secret) {
+        return this.token(secret);
+    }
     async token(secret) {
         const key = `${secret.account}\0${secret.from}`;
         const known = this.tokens.get(key);

package/dist/server/run-plan.js

@@ -1,15 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.refuseArguments = exports.planRun = exports.getRunScopes = void 0;
+exports.describeArguments = exports.refuseArguments = exports.planRun = exports.getRunScopes = void 0;
 const parse_label_arguments_1 = require("../parser/parse-label-arguments");
 const plan_1 = require("./plan");
 function labels(values) {
     return values && values.length > 0 ? (0, parse_label_arguments_1.parseLabelArguments)(values) : undefined;
 }
-// The tasks in the order they were named, one scope each; by labels when none is.
+// The tasks in the order they were named, one scope each; by labels when none is. A
+// service run is one scope of its services.
 // The arguments, if any, go to the one task named (the request allows no more). That
 // task runs uncached unless the request names a `cache` method, as `run --cache` does.
-function getRunScopes(tasks, options) {
+function getRunScopes(tasks, options, services = []) {
+    if (services.length > 0) {
+        return [{ name: services.join(', '), scope: { serviceNames: services, environmentName: options.env ?? null } }];
+    }
     const args = options.args && options.args.length > 0
         ? { values: options.args, services: false, cache: options.cache !== undefined }
         : undefined;
@@ -37,7 +41,7 @@ exports.getRunScopes = getRunScopes;
  */
 async function planRun(bundle, run, environment, policy) {
     const plan = {};
-    for (const { scope } of getRunScopes(run.tasks, run.options)) {
+    for (const { scope } of getRunScopes(run.tasks, run.options, run.up?.services ?? run.services)) {
         Object.assign(plan, (await (0, plan_1.planBundle)(bundle, environment, { scope, policy })).plan);
     }
     return {
@@ -46,26 +50,16 @@ async function planRun(bundle, run, environment, policy) {
     };
 }
 exports.planRun = planRun;
-// Variables of a server that hold no credential (FR-008): a task may read these and
-// still take arguments.
-const PLAIN_SERVER_ENVS = ['PATH', 'HOME', 'CI'];
-function readsOf(entry) {
-    return [
-        ...entry.secrets.map((secret) => `the secret ${secret.target}`),
-        ...(entry.serverEnvs ?? [])
-            .filter((env) => !PLAIN_SERVER_ENVS.includes(env.toUpperCase()))
-            .map((env) => `$${env} of the server`),
-    ];
-}
 /**
  * Why a run may not pass its arguments, or null when it may. They go to a task, never a
  * service, and never to a run in which an item reads a secret or takes a variable of the
  * server into its `envs`: an argument can make the command print what the task holds,
  * and what its dependencies write into their outputs or its services serve, past the
  * masking of secrets. So a shell on a server runs with no account and no credential of
- * the server.
+ * the server. Under `runs.args: declared` they go only to a task that says `args: true`,
+ * so a task nobody meant to take them never does.
  */
-function refuseArguments(run, plan) {
+function refuseArguments(run, plan, policy = {}) {
     if (!run.options.args || run.options.args.length === 0) {
         return null;
     }
@@ -75,14 +69,21 @@ function refuseArguments(run, plan) {
     if (!entry || entry.kind !== 'task') {
         return `${name} is not a task of this version`;
     }
-    const reads = readsOf(entry);
+    // planning the run refuses it before, this keeps the check with the others
+    if (entry.args === false) {
+        return `${name} takes no arguments (args: false)`;
+    }
+    if (policy.args === 'declared' && entry.args !== true) {
+        return `${name} takes no arguments on this server: it takes them only for tasks that say args: true (runs.args: declared)`;
+    }
+    const reads = (0, plan_1.getCredentialReads)(entry);
     if (reads.length > 0) {
         return `${name} reads ${reads.join(', ')}, it takes no arguments on a server: an argument could make it print them`;
     }
     // what a dependency or a service of the run holds reaches the task through its outputs or
     // its answers, where an argument can print it in a form no mask knows (`rev token.txt`)
     for (const [other, item] of Object.entries(plan).sort(([a], [b]) => a.localeCompare(b))) {
-        const held = (other === name ? [] : readsOf(item)).join(', ');
+        const held = (other === name ? [] : (0, plan_1.getCredentialReads)(item)).join(', ');
         if (held.length > 0) {
             return `${name} takes no arguments on a server: ${other} in its run reads ${held}, and an argument could make ${name} print what ${other} hands on`;
         }
@@ -90,4 +91,34 @@ function refuseArguments(run, plan) {
     return null;
 }
 exports.refuseArguments = refuseArguments;
+/**
+ * For each task of a version, whether a run of it alone may pass arguments: null when it may,
+ * else why not, as {@link refuseArguments} answers a run. The plan is the one of the whole
+ * version: a task's run is the task with its dependencies and services.
+ */
+function describeArguments(plan, policy = {}) {
+    const described = {};
+    for (const [name, entry] of Object.entries(plan)) {
+        if (entry.kind !== 'task') {
+            continue;
+        }
+        const run = {};
+        const visit = (item) => {
+            if (run[item] || !plan[item]) {
+                return;
+            }
+            run[item] = plan[item];
+            for (const next of [...plan[item].deps, ...plan[item].needs]) {
+                visit(next);
+            }
+        };
+        visit(name);
+        described[name] =
+            entry.command === null
+                ? `${name} has no command to take arguments`
+                : refuseArguments({ tasks: [name], options: { args: ['-'] } }, run, policy);
+    }
+    return described;
+}
+exports.describeArguments = describeArguments;
 //# sourceMappingURL=run-plan.js.map