laneyard 0.1.0 → 0.3.0

package/dist/src/server/auth.js

@@ -37,45 +37,113 @@ export async function verifyPassword(password, stored) {
         return false;
     }
 }
+/**
+ * A hash no password matches, used to spend the same work on an unknown name.
+ *
+ * Built from random bytes rather than by hashing something: `hashPassword` is
+ * synchronous and would freeze the server for its duration. The shape is what
+ * matters — `verifyPassword` derives a 32-byte key with the same parameters and
+ * then fails the comparison, which is exactly what a wrong password costs.
+ */
+const DECOY_HASH = `scrypt$${randomBytes(16).toString("hex")}$${randomBytes(32).toString("hex")}`;
+/**
+ * Turns a name and a password into who that is, or into nothing.
+ *
+ * An unknown name is verified against a decoy hash instead of returning early.
+ * Without that, a refusal for a name that does not exist comes back in
+ * microseconds while a wrong password takes the thirty milliseconds scrypt
+ * costs — and the login form becomes a way to enumerate accounts before trying
+ * a single password against them.
+ */
+export async function authenticate(users, name, password) {
+    const user = users.find((u) => u.name === name);
+    if (!user) {
+        await verifyPassword(password, DECOY_HASH);
+        return null;
+    }
+    if (!(await verifyPassword(password, user.password_hash)))
+        return null;
+    return { name: user.name, role: user.role };
+}
 /** In-memory sessions: they don't survive a restart, and that's just fine. */
 export class SessionStore {
-    tokens = new Set();
-    issue() {
+    tokens = new Map();
+    issue(identity) {
         const token = randomBytes(32).toString("hex");
-        this.tokens.add(token);
+        this.tokens.set(token, identity);
         return token;
     }
+    /** Who the token belongs to, or undefined if it belongs to nobody. */
+    get(token) {
+        return token === undefined ? undefined : this.tokens.get(token);
+    }
     valid(token) {
-        return token !== undefined && this.tokens.has(token);
+        return this.get(token) !== undefined;
     }
     revoke(token) {
         this.tokens.delete(token);
     }
+    /**
+     * Drops every session belonging to a name.
+     *
+     * The identity is snapshotted when the session is issued, which is what makes
+     * a request cheap — but it also means removing an account or changing its role
+     * leaves the old answer live in whatever browsers already had it. Without this,
+     * "remove the account" and "revoke access" are two different things, while
+     * every interface that offers the first implies the second.
+     */
+    revokeAllFor(name) {
+        for (const [token, identity] of this.tokens) {
+            if (identity.name === name)
+                this.tokens.delete(token);
+        }
+    }
 }
 export const SESSION_COOKIE = "laneyard_session";
+/** Past this many tracked names, the entries that no longer delay anyone go. */
+const THROTTLE_PRUNE_ABOVE = 1_000;
 /**
- * Slows down repeated login attempts.
+ * Slows down repeated login attempts, one account at a time.
  *
  * Without this, a network neighbour could try passwords as fast as the
  * server responds. The delay grows with failures and resets to zero on a
  * success: the legitimate user who mistypes once doesn't feel it.
+ *
+ * Counted per name rather than globally: a single counter means anyone able to
+ * reach the login form can lock out every account on the server by hammering
+ * one name — a denial of service disguised as a security measure.
  */
 export class LoginThrottle {
-    failures = 0;
-    until = 0;
-    /** Milliseconds left to wait, 0 if the way is clear. */
-    retryAfterMs(now = Date.now()) {
-        return Math.max(0, this.until - now);
+    perName = new Map();
+    /** Milliseconds left to wait for that name, 0 if the way is clear. */
+    retryAfterMs(name, now = Date.now()) {
+        return Math.max(0, (this.perName.get(name)?.until ?? 0) - now);
     }
-    recordFailure(now = Date.now()) {
-        this.failures += 1;
+    recordFailure(name, now = Date.now()) {
+        const state = this.perName.get(name) ?? { failures: 0, until: 0 };
+        state.failures += 1;
         // 0, 0, 0, then 1s, 2s, 4s… capped at one minute.
-        if (this.failures > 3) {
-            this.until = now + Math.min(60_000, 2 ** (this.failures - 4) * 1000);
+        if (state.failures > 3) {
+            state.until = now + Math.min(60_000, 2 ** (state.failures - 4) * 1000);
         }
+        this.perName.set(name, state);
+        // The key is whatever the caller sent, so an attacker chooses how many
+        // entries exist. Dropping those whose delay has run out bounds the map by
+        // how fast someone can be delayed, not by how many names they can invent.
+        if (this.perName.size > THROTTLE_PRUNE_ABOVE)
+            this.prune(now);
     }
-    recordSuccess() {
-        this.failures = 0;
-        this.until = 0;
+    recordSuccess(name) {
+        this.perName.delete(name);
+    }
+    /** Number of names currently tracked. Exposed so the pruning can be tested. */
+    size() {
+        return this.perName.size;
+    }
+    prune(now) {
+        for (const [name, state] of this.perName) {
+            if (state.until <= now)
+                this.perName.delete(name);
+        }
     }
 }

package/dist/src/server/permissions.js

@@ -0,0 +1,73 @@
+/**
+ * Who can do what — the whole answer, in one file.
+ *
+ * A permission expressed as an `if` inside a handler is a permission nobody
+ * finds when it matters: during an audit, or after an incident. So there are no
+ * such `if`s. Every route that needs more than a session is named below, and the
+ * single hook in `app.ts` is the only thing that reads this.
+ *
+ * Two roles, and only two. `admin` may do everything; `builder` may start a
+ * build, watch it, cancel it and download what it produced — nothing that
+ * changes what a build does, and nothing that reveals a credential.
+ */
+/**
+ * What each route needs. Everything absent from this list needs only a session.
+ *
+ * Reading the Fastfile is deliberately not here: a builder who can start a lane
+ * benefits from seeing what it does, and it contains no credential — anything
+ * that does is in the vault, which is.
+ */
+export const REQUIRES_ADMIN = [
+    { method: "*", path: "/api/secrets" },
+    { method: "*", path: "/api/projects/:slug/secrets" },
+    { method: "PUT", path: "/api/projects/:slug/fastfile" },
+    { method: "POST", path: "/api/projects/:slug/commit" },
+    { method: "POST", path: "/api/projects/:slug/push" },
+    { method: "DELETE", path: "/api/projects/:slug" },
+    { method: "*", path: "/api/users" },
+];
+/**
+ * `/api/secrets/APP_KEY?x=1` → `["api", "secrets", "APP_KEY"]`.
+ *
+ * Each segment is percent-decoded, because the router decodes before it matches
+ * and this must see the same path the router did. Comparing the raw text sent
+ * `GET /api/%73ecrets` straight past the admin list and into the vault: Fastify
+ * routed it to `/api/secrets`, and this function had been looking at `%73ecrets`.
+ */
+function segments(url) {
+    return (url.split("?")[0] ?? "")
+        .split("/")
+        .filter((s) => s !== "")
+        .map((s) => {
+        try {
+            return decodeURIComponent(s);
+        }
+        catch {
+            // Malformed escapes reach no route either; left as-is rather than
+            // swallowed, so a segment is never silently emptied into a match.
+            return s;
+        }
+    });
+}
+/**
+ * Does this request need an admin?
+ *
+ * A pattern matches a request whose path *starts with* it, segment by segment,
+ * with `:name` standing for any one segment. The prefix is deliberate:
+ * `/api/secrets` means the vault, not one URL, and a table naming every key's
+ * route separately would be a table someone forgets to extend the next time a
+ * route is added under it. It only ever errs towards refusing, since every
+ * entry here is a restriction.
+ */
+export function requiresAdmin(method, url) {
+    const parts = segments(url);
+    const verb = method.toUpperCase();
+    return REQUIRES_ADMIN.some((pattern) => {
+        if (pattern.method !== "*" && pattern.method.toUpperCase() !== verb)
+            return false;
+        const expected = segments(pattern.path);
+        if (parts.length < expected.length)
+            return false;
+        return expected.every((seg, i) => seg.startsWith(":") || seg === parts[i]);
+    });
+}

package/dist/src/server/routes/fastfile.js

@@ -0,0 +1,131 @@
+import { join } from "node:path";
+import { FastfileStore } from "../../fastfile/store.js";
+import { Workspace } from "../../git/workspace.js";
+export async function registerFastfileRoutes(app, ctx) {
+    // Stateless: the previous content it keeps in memory during a write lives
+    // on the call stack, not on the instance, so sharing one across requests
+    // costs nothing and mirrors how the other routes reuse a single `Workspace`.
+    const store = new FastfileStore();
+    /**
+     * Common preamble: the project must exist and its clone must be present —
+     * the Fastfile, like the lane list, lives in the repository. Sends the
+     * response itself and returns null on failure so callers can bail out with
+     * a single early return.
+     */
+    const ready = async (slug, reply) => {
+        const entry = ctx.config.project(slug);
+        if (!entry) {
+            reply.code(404).send({ error: "Unknown project" });
+            return null;
+        }
+        try {
+            await ctx.ensureWorkspace(slug);
+        }
+        catch (cause) {
+            reply.code(503).send({ error: cause.message });
+            return null;
+        }
+        const workspacePath = ctx.workspacePath(slug);
+        const resolved = await ctx.config.resolve(slug, workspacePath);
+        return {
+            workspacePath,
+            fastlaneDir: resolved.settings.fastlane_dir,
+            workspace: new Workspace(workspacePath, entry.git_url, entry.git_auth),
+            defaultBranch: entry.default_branch,
+        };
+    };
+    app.get("/api/projects/:slug/fastfile", async (req, reply) => {
+        const { slug } = req.params;
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        try {
+            const [content, dirty, diff] = await Promise.all([
+                store.read(r.workspacePath, r.fastlaneDir),
+                r.workspace.isDirty(),
+                r.workspace.diff(join(r.fastlaneDir, "Fastfile")),
+            ]);
+            return { content, dirty, diff };
+        }
+        catch (cause) {
+            // Unreadable Fastfile — deleted by hand, say — is the same kind of
+            // "could not tell" as an unreadable lane list elsewhere in the API.
+            return reply.code(503).send({ error: cause.message });
+        }
+    });
+    app.put("/api/projects/:slug/fastfile", async (req, reply) => {
+        const { slug } = req.params;
+        const { content } = (req.body ?? {});
+        if (typeof content !== "string") {
+            return reply.code(400).send({ error: "content is required" });
+        }
+        // The one refusal in this file, and not a heuristic: a run in flight is
+        // reading the very file this write would replace, the same reason
+        // `Workspace.prepare` refuses to touch a dirty workspace.
+        if (ctx.runs.hasActiveRun(slug)) {
+            return reply.code(409).send({
+                error: "A run is in progress for this project. Wait for it to finish before editing the Fastfile.",
+            });
+        }
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        // Asks the sidecar for the lanes: that parses the file and lists what it
+        // found, which is exactly the two things that matter here — it still
+        // parses, and the lanes are still there. The introspection cache is keyed
+        // on a hash of the whole fastlane folder, so the changed content here is
+        // what makes the next read of the lane list fresh — no separate
+        // invalidation step needed.
+        const verify = async () => {
+            try {
+                await ctx.lanes(slug, r.workspacePath, r.fastlaneDir);
+                return { ok: true };
+            }
+            catch (cause) {
+                return { ok: false, reason: cause.message };
+            }
+        };
+        const result = await store.write(r.workspacePath, content, verify, r.fastlaneDir);
+        if (!result.ok)
+            return reply.code(400).send({ error: result.reason });
+        return reply.code(204).send();
+    });
+    app.get("/api/projects/:slug/changes", async (req, reply) => {
+        const { slug } = req.params;
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        const [files, diff] = await Promise.all([r.workspace.status(), r.workspace.diff()]);
+        return { files, diff };
+    });
+    app.post("/api/projects/:slug/commit", async (req, reply) => {
+        const { slug } = req.params;
+        const { message } = (req.body ?? {});
+        if (!message)
+            return reply.code(400).send({ error: "A commit message is required" });
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        // Exactly what changed, never `git add -A`: a build leaves files
+        // scattered in the workspace, and this is the one place that must not
+        // scoop them up because they happened to be there.
+        const files = await r.workspace.status();
+        if (files.length === 0)
+            return reply.code(400).send({ error: "Nothing to commit" });
+        await r.workspace.commit(message, files);
+        return reply.code(204).send();
+    });
+    app.post("/api/projects/:slug/push", async (req, reply) => {
+        const { slug } = req.params;
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        try {
+            await r.workspace.push(r.defaultBranch);
+            return reply.code(204).send();
+        }
+        catch (cause) {
+            return reply.code(400).send({ error: cause.message });
+        }
+    });
+}

package/dist/src/server/routes/projects.js

@@ -1,3 +1,5 @@
+import { existsSync } from "node:fs";
+import { removeProjectFromConfig } from "../../cli/setup.js";
 export async function registerProjectRoutes(app, ctx) {
     app.get("/api/projects", async () => ctx.config.projects().map((p) => {
         const last = ctx.runs.listByProject(p.slug, 1)[0] ?? null;
@@ -8,6 +10,46 @@ export async function registerProjectRoutes(app, ctx) {
             lastRun: last && { id: last.id, status: last.status, lane: last.lane, finishedAt: last.finishedAt },
         };
     }));
+    /**
+     * Stops showing a project. It is the one destructive route in the product,
+     * and what it does not destroy is most of the point:
+     *
+     *  - the project's block leaves config.yml, through the YAML document so the
+     *    rest of a hand-written file is untouched;
+     *  - its runs stay in the database, still reachable at their own URL — the
+     *    history of what this machine built is not the project's to take away;
+     *  - the clone and the artifacts stay on disk, named in the answer so they
+     *    can be removed by hand. Deleting files someone may still want, from a
+     *    web page, on one click, is not a thing to do.
+     */
+    app.delete("/api/projects/:slug", async (req, reply) => {
+        const { slug } = req.params;
+        const entry = ctx.config.project(slug);
+        if (!entry)
+            return reply.code(404).send({ error: "Unknown project" });
+        // A run that has begun is reading the workspace this project points at.
+        // Queued runs are not: the queue already fails a run whose project went
+        // away, so waiting on them would only mean refusing for longer.
+        if (ctx.runs.hasActiveRun(slug)) {
+            return reply.code(409).send({
+                error: `"${slug}" has a run in flight. Wait for it to finish, or cancel it, then remove the project.`,
+            });
+        }
+        const removed = await removeProjectFromConfig(ctx.config.configPath(), slug);
+        if (!removed)
+            return reply.code(404).send({ error: "Unknown project" });
+        // The file is watched, but on a debounce: reloading here is what makes the
+        // very next request — the listing this page is about to ask for — truthful.
+        await ctx.config.load();
+        // -1 is SQLite's "no limit": the answer names every artifact folder left
+        // behind, and a project with sixty runs must not be told about fifty of them.
+        const runs = ctx.runs.listByProject(slug, -1);
+        const leftOnDisk = [
+            ctx.workspacePath(slug),
+            ...runs.map((run) => ctx.artifactsDir(run.id)),
+        ].filter((path) => existsSync(path));
+        return reply.send({ slug, name: entry.name, runsKept: runs.length, leftOnDisk });
+    });
     app.get("/api/projects/:slug/lanes", async (req, reply) => {
         const { slug } = req.params;
         const entry = ctx.config.project(slug);
@@ -30,6 +72,13 @@ export async function registerProjectRoutes(app, ctx) {
         const { slug } = req.params;
         if (!ctx.config.project(slug))
             return reply.code(404).send({ error: "Unknown project" });
-        return ctx.runs.listByProject(slug);
+        // The whole line is read once and the positions are looked up in it, rather
+        // than asking the database where each of fifty runs stands. The position is
+        // the global one: the queue is shared by every project.
+        const line = ctx.runs.queued().map((r) => r.id);
+        return ctx.runs.listByProject(slug).map((run) => {
+            const at = line.indexOf(run.id);
+            return { ...run, queuePosition: at === -1 ? null : at + 1 };
+        });
     });
 }

package/dist/src/server/routes/readiness.js

@@ -0,0 +1,102 @@
+import { execFile } from "node:child_process";
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { glob } from "tinyglobby";
+import { Workspace } from "../../git/workspace.js";
+import { resolvePlatforms } from "../../heuristics/platforms.js";
+import { runChecklist } from "../../heuristics/readiness.js";
+const exec = promisify(execFile);
+/**
+ * `bundle check` in the workspace, rejecting with what bundler said.
+ *
+ * Installs nothing: the checklist reports, it does not act. The timeout is
+ * generous because bundler resolves the whole Gemfile.lock, and short enough
+ * that a wedged bundler does not hold the request open.
+ */
+async function bundleCheck(cwd) {
+    try {
+        const { stdout } = await exec("bundle", ["check"], { cwd, timeout: 60_000 });
+        return stdout.trim();
+    }
+    catch (cause) {
+        const err = cause;
+        throw new Error((err.stdout || err.stderr || err.message).trim());
+    }
+}
+/** The path of a `fastlane` a run would find, or null. */
+async function findFastlane() {
+    try {
+        const { stdout } = await exec("which", ["fastlane"], { timeout: 5_000 });
+        return stdout.trim() || null;
+    }
+    catch {
+        // A non-zero exit from `which` is the answer "no", not a failure.
+        return null;
+    }
+}
+/** The globbing `heuristics/platforms.ts` asks for, bound to the workspace. */
+const findIn = (dir) => (globs, { onlyDirectories }) => glob(globs, onlyDirectories ? { cwd: dir, onlyDirectories: true } : { cwd: dir, onlyFiles: true });
+const exists = async (path) => access(path).then(() => true, () => false);
+export async function registerReadinessRoutes(app, ctx) {
+    /**
+     * Computed only when asked for.
+     *
+     * These checks shell out to git and to bundler, so nothing else in the
+     * interface may trigger them: the tab asks when it is opened, and when the
+     * user presses refresh. Nothing here is cached either — a stale green tick is
+     * worse than a red cross, which is why the answer carries the time it was
+     * produced.
+     */
+    app.get("/api/projects/:slug/readiness", async (req, reply) => {
+        const { slug } = req.params;
+        const entry = ctx.config.project(slug);
+        if (!entry)
+            return reply.code(404).send({ error: "Unknown project" });
+        const workspacePath = ctx.workspacePath(slug);
+        const workspace = new Workspace(workspacePath, entry.git_url, entry.git_auth);
+        // What each lane calls lives in the repository, so the clone has to exist.
+        // A clone that fails is not an error page: it is the reason two of the five
+        // checks cannot answer, and the other three still can.
+        let unreachable = null;
+        try {
+            await ctx.ensureWorkspace(slug);
+        }
+        catch (cause) {
+            unreachable = cause.message;
+        }
+        const resolved = await ctx.config.resolve(slug, workspacePath);
+        const fastlaneDir = resolved?.settings.fastlane_dir ?? "fastlane";
+        const uses = unreachable !== null
+            ? { ok: false, reason: unreachable }
+            : await ctx
+                .uses(slug, workspacePath, fastlaneDir)
+                .then((lanes) => ({ ok: true, value: lanes }))
+                // Broken Fastfile, no Ruby, no fastlane: all of them are "could not
+                // tell", none of them is a 500.
+                .catch((cause) => ({ ok: false, reason: cause.message }));
+        // What the project builds for decides which half of the checklist applies.
+        // `laneyard.yml` answers on its own; without it the workspace is looked at,
+        // and an unreachable workspace is a "could not tell" rather than a claim
+        // that the repository holds neither an Xcode project nor a Gradle build.
+        const configured = resolved?.settings.platforms;
+        const platforms = unreachable !== null && (configured === undefined || configured.length === 0)
+            ? { ok: false, reason: unreachable }
+            : { ok: true, value: await resolvePlatforms(configured, findIn(workspacePath)) };
+        const sections = await runChecklist({
+            probeRepository: () => workspace.probeRemote(),
+            dependencies: {
+                workspace: unreachable !== null
+                    ? { ok: false, reason: unreachable }
+                    : { ok: true, value: { hasGemfile: await exists(join(workspacePath, "Gemfile")) } },
+                bundleCheck: () => bundleCheck(workspacePath),
+                findFastlane,
+            },
+            // Names only: the vault never hands a value to anything but a run.
+            secretKeys: ctx.vault.list(slug).map((s) => s.key),
+            uses,
+            platforms,
+        });
+        return { checkedAt: new Date().toISOString(), sections };
+    });
+}

package/dist/src/server/routes/runs.js

@@ -1,5 +1,6 @@
 import { createReadStream } from "node:fs";
-import { executeRun } from "../../runner/orchestrate.js";
+/** Statuses a run can still be cancelled from. */
+const CANCELLABLE = ["queued", "preparing", "running"];
 export async function registerRunRoutes(app, ctx) {
     app.post("/api/projects/:slug/runs", async (req, reply) => {
         const { slug } = req.params;
@@ -9,17 +10,6 @@ export async function registerRunRoutes(app, ctx) {
             return reply.code(404).send({ error: "Unknown project" });
         if (!body.lane)
             return reply.code(400).send({ error: "Missing lane" });
-        // Only one run at a time per project: they share the same git workspace.
-        // Two concurrent runs would silently trip over each other — one would
-        // change the commit out from under the other, carry off its artifacts
-        // and delete its report. The real queue comes at the next milestone;
-        // this refusal, for its part, already prevents false results.
-        const last = ctx.runs.listByProject(slug, 1)[0];
-        if (last && ["queued", "preparing", "running"].includes(last.status)) {
-            return reply.code(409).send({
-                error: `Run #${last.id} is still in progress on this project. Wait for it to finish.`,
-            });
-        }
         // We check that the lane genuinely exists before creating a run doomed to fail.
         try {
             await ctx.ensureWorkspace(slug);
@@ -38,45 +28,37 @@ export async function registerRunRoutes(app, ctx) {
             platform: body.platform ?? null,
             params: body.params ?? {},
         });
-        // Launched without waiting: the HTTP response mustn't take as long as a build.
-        void executeRun({
-            runId: id,
-            runs: ctx.runs,
-            logs: ctx.logs,
-            workspacePath: ctx.workspacePath(slug),
-            artifactsDir: ctx.artifactsDir(id),
-            gitUrl: entry.git_url,
-            gitAuth: entry.git_auth,
-            branch: entry.default_branch,
-            // Resolved after the clone, once the repository's laneyard.yml is finally readable.
-            resolveSettings: async () => {
-                const r = await ctx.config.resolve(slug, ctx.workspacePath(slug));
-                return r.settings;
-            },
-            env: process.env,
-            onChunk: (chunk, offset) => app.broadcastRunChunk?.(id, chunk, offset),
-        })
-            .then((r) => ctx.sockets?.finish(id, r.status))
-            .catch((cause) => {
-            // Last safety net. `executeRun` commits to never throwing, but a
-            // rejected promise with no handler brings down the whole Node
-            // process — and with it, the other runs in progress. The cost of
-            // forgetting this would be disproportionate.
-            ctx.runs.finish(id, {
-                status: "failed",
-                exitCode: null,
-                errorSummary: `Unexpected failure: ${cause.message}`,
-            });
-            ctx.sockets?.finish(id, "failed");
-        });
-        return reply.code(201).send({ id });
+        // Read before the queue is woken, so the answer describes the line the
+        // caller just joined rather than one the worker has already moved on from.
+        const queuePosition = ctx.runs.queuePosition(id);
+        // The route creates a row and rings the bell; the worker does the rest.
+        app.queue.wake();
+        return reply.code(201).send({ id, queuePosition });
     });
     app.get("/api/runs/:id", async (req, reply) => {
         const id = Number(req.params.id);
         const run = ctx.runs.get(id);
         if (!run)
             return reply.code(404).send({ error: "Unknown run" });
-        return { ...run, steps: ctx.runs.steps(id), artifacts: ctx.runs.artifacts(id) };
+        return {
+            ...run,
+            queuePosition: ctx.runs.queuePosition(id),
+            steps: ctx.runs.steps(id),
+            artifacts: ctx.runs.artifacts(id),
+        };
+    });
+    app.post("/api/runs/:id/cancel", async (req, reply) => {
+        const id = Number(req.params.id);
+        const run = ctx.runs.get(id);
+        if (!run)
+            return reply.code(404).send({ error: "Unknown run" });
+        if (!CANCELLABLE.includes(run.status)) {
+            return reply.code(409).send({ error: `Run #${id} has already finished` });
+        }
+        // A queued run is finished on the spot; a running one is signalled and ends
+        // a few moments later. Either way the caller has nothing left to wait for.
+        app.queue.cancel(id);
+        return reply.code(204).send();
     });
     app.get("/api/runs/:id/log", async (req, reply) => {
         const id = Number(req.params.id);

package/dist/src/server/routes/secrets.js

@@ -0,0 +1,51 @@
+import { MIN_LENGTH as MIN_REDACTABLE } from "../../logs/redact.js";
+/** POSIX environment variable names. Anything else would never reach fastlane. */
+const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export async function registerSecretRoutes(app, ctx) {
+    const listRoute = (slug) => slug === null ? ctx.vault.listGlobal() : ctx.vault.list(slug);
+    app.get("/api/secrets", async () => listRoute(null));
+    app.get("/api/projects/:slug/secrets", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return listRoute(slug);
+    });
+    const put = async (slug, key, body, reply) => {
+        const { value, masked } = (body ?? {});
+        if (!VALID_KEY.test(key)) {
+            return reply.code(400).send({
+                error: `"${key}" is not a valid environment variable name: letters, digits and underscore, not starting with a digit.`,
+            });
+        }
+        if (typeof value !== "string" || value === "") {
+            return reply.code(400).send({ error: "A value is required" });
+        }
+        // Accepting the tick box and quietly not honouring it would leave someone
+        // believing they are protected. Refusing is the honest answer.
+        if (masked !== false && value.length < MIN_REDACTABLE) {
+            return reply.code(400).send({
+                error: `A value kept out of the logs must be at least ${MIN_REDACTABLE} characters. ` +
+                    "Shorter than that, removing it would shred the log without hiding anything. " +
+                    "Store it unmasked if you accept it appearing in the output.",
+            });
+        }
+        await ctx.vault.set(slug, key, value, masked !== false);
+        return reply.code(204).send();
+    };
+    app.put("/api/secrets/:key", async (req, reply) => put(null, req.params.key, req.body, reply));
+    app.put("/api/projects/:slug/secrets/:key", async (req, reply) => {
+        const { slug, key } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return put(slug, key, req.body, reply);
+    });
+    app.delete("/api/secrets/:key", async (req, reply) => {
+        const removed = ctx.vault.remove(null, req.params.key);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown secret" });
+    });
+    app.delete("/api/projects/:slug/secrets/:key", async (req, reply) => {
+        const { slug, key } = req.params;
+        const removed = ctx.vault.remove(slug, key);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown secret" });
+    });
+}