Sign in

flagon-io/g1t

public

g1t/services/repos/src/store.rs

1,324 lines56,913 bytesCodeBlame
1//! The storage that actually holds git repositories.
2//!
3//! The service depends on the [`GitStore`] and [`GitRepo`] ports;
4//! [`ArtifactsStore`] is the adapter for Cloudflare Artifacts.
5//!
6//! Every call on the binding goes through [`invoke`]: it is counted
7//! (meters.rs), timed for the store's health, refused at once while its
8//! namespace's breaker is open, and tried again after a failure that may
9//! pass when it only reads (resilience.rs). Repositories may live in
10//! several namespaces (shards.rs).
11
12use g1t_contracts::repos::{Branch, Commit, EntryKind, GitAccess, Signature, TreeEntry};
13use g1t_contracts::time::rfc3339;
14use g1t_kit::js::{self, Thrown};
15use serde::{Deserialize, Serialize};
16use std::cell::RefCell;
17use std::collections::HashMap;
18use std::rc::Rc;
19use worker::js_sys::{Reflect, Uint8Array};
20use worker::wasm_bindgen::{JsCast, JsValue};
21use worker::{Env, Result};
22
23use crate::fallback;
24use crate::meters::{self, Outcome};
25use crate::resilience::{self, Admit, Busy, Failure};
26use crate::shards;
27
28/// Credentials that never leave this service: g1t has already decided who
29/// may do what before one is used. They live an hour and are used for 50
30/// minutes, so each one used has at least ten minutes left.
31const INTERNAL_TTL_SECONDS: u32 = 3_600;
32const INTERNAL_REUSE_MS: u64 = 50 * 60 * 1000;
33/// Credentials handed out (`git_access`, to sandboxes): five minutes, used
34/// for three, so whoever gets one has at least two.
35const HANDOUT_TTL_SECONDS: u32 = 300;
36const HANDOUT_REUSE_MS: u64 = 180_000;
37/// How long a handed-out credential stays valid, in milliseconds.
38pub const CREDENTIAL_LIFE_MS: u64 = HANDOUT_TTL_SECONDS as u64 * 1000;
39
40#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
41pub enum Scope {
42 Read,
43 Write,
44}
45
46impl Scope {
47 fn as_str(self) -> &'static str {
48 match self {
49 Scope::Read => "read",
50 Scope::Write => "write",
51 }
52 }
53}
54
55/// Who a credential is for.
56#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
57pub enum Use {
58 /// This service, talking to the store itself.
59 Internal,
60 /// Someone outside it, through `git_access`.
61 Handout,
62}
63
64impl Use {
65 pub fn ttl_seconds(self) -> u32 {
66 match self {
67 Use::Internal => INTERNAL_TTL_SECONDS,
68 Use::Handout => HANDOUT_TTL_SECONDS,
69 }
70 }
71
72 pub fn reuse_ms(self) -> u64 {
73 match self {
74 Use::Internal => INTERNAL_REUSE_MS,
75 Use::Handout => HANDOUT_REUSE_MS,
76 }
77 }
78
79 fn as_str(self) -> &'static str {
80 match self {
81 Use::Internal => "internal",
82 Use::Handout => "handout",
83 }
84 }
85}
86
87/// Where a credential handed out came from, for `Server-Timing`.
88#[derive(Clone, Copy, PartialEq, Eq, Debug)]
89pub enum Kept {
90 /// This isolate made it, or had it from another, a moment ago.
91 Isolate,
92 /// Another isolate made it and shared it.
93 Shared,
94}
95
96impl Kept {
97 pub fn as_str(self) -> &'static str {
98 match self {
99 Kept::Isolate => "isolate",
100 Kept::Shared => "shared",
101 }
102 }
103}
104
105/// A place repositories live. `key` is the store's own name for a repo.
106#[allow(async_fn_in_trait)]
107pub trait GitStore {
108 type Repo: GitRepo;
109
110 /// Creates an empty repository. Succeeds if it already exists.
111 async fn create(&self, key: &str, description: Option<&str>, default_branch: &str) -> Result<()>;
112 async fn open(&self, key: &str) -> Result<Self::Repo>;
113 /// A credential for `key` made a moment ago, if the store keeps one.
114 async fn kept_access(&self, _key: &str, _scope: Scope) -> Option<(GitAccess, Kept)> {
115 None
116 }
117 /// A new credential for `key`, which the store may keep for next time.
118 async fn mint_access(&self, key: &str, scope: Scope) -> Result<GitAccess> {
119 self.open(key).await?.access(scope).await
120 }
121 /// A remote URL and credential for this service's own use. A store may
122 /// hand out one it made a moment ago.
123 async fn access(&self, key: &str, scope: Scope) -> Result<GitAccess> {
124 match self.kept_access(key, scope).await {
125 Some((access, _)) => Ok(access),
126 None => self.mint_access(key, scope).await,
127 }
128 }
129 /// A short-lived credential for someone outside this service.
130 async fn handout(&self, key: &str, scope: Scope) -> Result<GitAccess> {
131 self.access(key, scope).await
132 }
133 /// Stops handing out the credentials it keeps for `key`: the store
134 /// turned one down, or the repository is gone.
135 async fn forget_access(&self, _key: &str) {}
136 /// Removes a repository and everything in it, for good. Succeeds if it
137 /// is already gone.
138 async fn delete(&self, key: &str) -> Result<()>;
139 /// The namespaces new repositories may be placed in (shards.rs).
140 fn namespaces(&self) -> Vec<String> {
141 vec![shards::DEFAULT_NAMESPACE.to_owned()]
142 }
143 /// The namespace bound as the default.
144 fn default_namespace(&self) -> String {
145 shards::DEFAULT_NAMESPACE.to_owned()
146 }
147 /// Whether the repository at `key` is served from the fallback store
148 /// now (fallback.rs): answers kept from the usual store may name refs
149 /// it does not have, so none are used.
150 fn on_fallback(&self, _key: &str) -> bool {
151 false
152 }
153 /// Whether `namespace` takes writes now: not while it is served from a
154 /// read-only fallback.
155 fn writable(&self, _namespace: &str) -> bool {
156 true
157 }
158}
159
160/// One open repository.
161#[allow(async_fn_in_trait)]
162pub trait GitRepo {
163 /// A remote URL and credential for git itself, for this service.
164 async fn access(&self, scope: Scope) -> Result<GitAccess>;
165 /// Every branch and the commit it points to.
166 async fn branches(&self) -> Result<Vec<Branch>>;
167 /// Newest first along the first-parent chain; empty for an unknown ref.
168 async fn log(&self, git_ref: &str, limit: u32) -> Result<Vec<Commit>>;
169 /// The parents of a commit, or `None` if the commit does not exist.
170 async fn parents(&self, commit_hash: &str) -> Result<Option<Vec<String>>>;
171 async fn read_tree(&self, tree_hash: &str) -> Result<Option<Vec<TreeEntry>>>;
172 async fn read_blob(&self, blob_hash: &str) -> Result<Option<Vec<u8>>>;
173 /// `None` when the ref or path does not resolve to a file.
174 async fn read_file(&self, git_ref: &str, path: &str) -> Result<Option<Vec<u8>>>;
175 /// Makes a copy of this repository under `target_key`, in the same
176 /// namespace.
177 async fn fork(&self, target_key: &str) -> Result<()>;
178 /// The version of the repository's refs (registry.rs `RefsState`),
179 /// when answers about branches may be kept under it (R9). Reads by
180 /// branch name are then kept until the version moves.
181 fn at_refs_version(&mut self, _version: Option<u64>) {}
182}
183
184thread_local! {
185 /// The namespace bound to `ARTIFACTS`, for keys that name none.
186 static DEFAULT_NS: RefCell<String> = RefCell::new(shards::DEFAULT_NAMESPACE.to_owned());
187 /// Where each namespace's remotes start: `https://<account>.artifacts.cloudflare.net/git/<namespace>/`.
188 static REMOTE_PREFIX: RefCell<HashMap<String, String>> = RefCell::new(HashMap::new());
189}
190
191/// The namespace and name a store key stands for.
192pub fn locate(key: &str) -> (String, String) {
193 let (namespace, name) = shards::split(key);
194 let namespace = namespace.map_or_else(|| DEFAULT_NS.with(|ns| ns.borrow().clone()), str::to_owned);
195 (namespace, name.to_owned())
196}
197
198thread_local! {
199 /// Where the fallback store's remotes start, when one is configured.
200 static FALLBACK_BASE: RefCell<Option<String>> = const { RefCell::new(None) };
201}
202
203/// Whose breaker and health git requests to `remote` count toward: its
204/// namespace's, or `<namespace>@fallback` for the fallback store's.
205pub fn health_namespace(remote: &str) -> String {
206 let (namespace, _) = locate(&key_from_remote(remote).unwrap_or_default());
207 let on_fallback = FALLBACK_BASE.with(|base| base.borrow().as_deref().is_some_and(|base| remote.starts_with(base)));
208 if on_fallback { format!("{namespace}@fallback") } else { namespace }
209}
210
211/// The store key a git remote is for, from its last two path segments.
212pub fn key_from_remote(remote: &str) -> Option<String> {
213 let path = remote.trim_end_matches('/');
214 let path = path.strip_suffix(".git").unwrap_or(path);
215 let (rest, name) = path.rsplit_once('/')?;
216 let namespace = rest.rsplit('/').next()?;
217 let default = DEFAULT_NS.with(|ns| ns.borrow().clone());
218 Some(shards::compose(Some(namespace), name, &default))
219}
220
221/// Where a namespace's remotes start, learned from one remote the store
222/// gave for `name`.
223fn learn_prefix(remote: &str, name: &str) -> Option<String> {
224 remote.strip_suffix(&format!("{name}.git")).filter(|prefix| prefix.ends_with('/')).map(str::to_owned)
225}
226
227/// A repository's remote, from where its namespace's remotes start.
228fn remote_from(prefix: &str, name: &str) -> String {
229 format!("{prefix}{name}.git")
230}
231
232struct Namespace {
233 name: String,
234 /// Its binding, for every call: Artifacts, or the fallback store.
235 target: Target,
236}
237
238/// What a call on the store goes to: an Artifacts binding or one of its
239/// repository handles, or the fallback store (fallback.rs) for a
240/// namespace, or for one repository in it.
241#[derive(Clone)]
242enum Target {
243 Js(JsValue),
244 Fallback {
245 settings: Rc<fallback::Settings>,
246 namespace: String,
247 repo: Option<String>,
248 },
249}
250
251impl Target {
252 fn is_fallback(&self) -> bool {
253 matches!(self, Target::Fallback { .. })
254 }
255
256 /// Whose breaker and health a call counts toward: the fallback store's
257 /// own, so an Artifacts outage never holds it back.
258 fn health_name(&self, namespace: &str) -> String {
259 if self.is_fallback() { format!("{namespace}@fallback") } else { namespace.to_owned() }
260 }
261}
262
263pub struct ArtifactsStore {
264 namespaces: Rc<Vec<Namespace>>,
265 /// Where isolates share the credentials they make; see shared.rs.
266 shared: Option<Rc<crate::shared::Shared>>,
267}
268
269impl ArtifactsStore {
270 pub fn new(env: &Env, shared: Option<Rc<crate::shared::Shared>>) -> Result<Self> {
271 let config = env.var("ARTIFACTS_NAMESPACES").ok().map(|value| value.to_string());
272 let text = |name: &str| env.var(name).ok().map(|value| value.to_string());
273 let secret = env.secret("GIT_FALLBACK_SECRET").ok().map(|value| value.to_string());
274 let fallback = fallback::Settings::from_vars(
275 text("GIT_FALLBACK_URL").as_deref(),
276 secret.as_deref(),
277 text("GIT_FALLBACK_NAMESPACES").as_deref(),
278 text("GIT_FALLBACK_WRITES").as_deref(),
279 )
280 .map(Rc::new);
281 FALLBACK_BASE.with(|base| *base.borrow_mut() = fallback.as_ref().map(|settings| format!("{}/git/", settings.url)));
282 let mut namespaces = Vec::new();
283 for (binding, name) in shards::bindings(config.as_deref()) {
284 // Served from the fallback store, by configuration.
285 if let Some(settings) = fallback.as_ref().filter(|settings| settings.serves(&name)) {
286 worker::console_log!("git store {name}: served from the fallback store");
287 let target = Target::Fallback { settings: settings.clone(), namespace: name.clone(), repo: None };
288 namespaces.push(Namespace { name, target });
289 continue;
290 }
291 match js::binding(env, &binding) {
292 Ok(value) => namespaces.push(Namespace { name, target: Target::Js(value) }),
293 // The default binding is required; the others are optional.
294 Err(error) if binding == shards::DEFAULT_BINDING => return Err(error),
295 Err(_) => worker::console_error!("ARTIFACTS_NAMESPACES names {binding}, which is not bound"),
296 }
297 }
298 if let Some(default) = namespaces.first() {
299 DEFAULT_NS.with(|ns| ns.borrow_mut().clone_from(&default.name));
300 }
301 // Optional: where remotes start, `https://<account>.artifacts.cloudflare.net/git`,
302 // so the first credential an isolate makes needs no `info()` either.
303 if let Ok(base) = env.var("ARTIFACTS_REMOTE_BASE") {
304 let base = base.to_string().trim_end_matches('/').to_owned();
305 if base.starts_with("https://") {
306 REMOTE_PREFIX.with(|prefixes| {
307 let mut prefixes = prefixes.borrow_mut();
308 for namespace in &namespaces {
309 prefixes.entry(namespace.name.clone()).or_insert_with(|| format!("{base}/{}/", namespace.name));
310 }
311 });
312 }
313 }
314 Ok(Self { namespaces: Rc::new(namespaces), shared })
315 }
316
317 fn binding(&self, namespace: &str) -> Result<&Target> {
318 self.namespaces
319 .iter()
320 .find(|candidate| candidate.name == namespace)
321 .map(|found| &found.target)
322 .ok_or_else(|| worker::Error::RustError(format!("git store namespace {namespace} is not bound")))
323 }
324
325 /// The fallback store's settings, when `namespace` is served from it.
326 fn fallback_of(&self, namespace: &str) -> Option<&fallback::Settings> {
327 match self.binding(namespace).ok()? {
328 Target::Fallback { settings, .. } => Some(settings),
329 Target::Js(_) => None,
330 }
331 }
332
333 /// The name credentials for `key` are kept under: those of the
334 /// fallback store never stand in for Artifacts' own, nor the reverse.
335 fn cred_key(&self, key: &str) -> String {
336 let (namespace, _) = locate(key);
337 cred_key(key, self.fallback_of(&namespace).is_some())
338 }
339}
340
341/// See [`ArtifactsStore::cred_key`].
342fn cred_key(key: &str, on_fallback: bool) -> String {
343 if on_fallback { format!("fallback:{key}") } else { key.to_owned() }
344}
345
346/// A failed call on the binding.
347pub struct StoreError {
348 pub thrown: Thrown,
349 pub busy: Option<Busy>,
350}
351
352impl StoreError {
353 pub fn is(&self, code: &str) -> bool {
354 self.thrown.is(code)
355 }
356}
357
358impl From<StoreError> for worker::Error {
359 fn from(error: StoreError) -> Self {
360 match error.busy {
361 Some(busy) => busy.error(&error.thrown.to_string()),
362 None => error.thrown.into(),
363 }
364 }
365}
366
367/// The meter for a binding method: `binding.create_token`.
368fn meter_of(method: &str) -> String {
369 let mut out = String::from("binding.");
370 for c in method.chars() {
371 if c.is_ascii_uppercase() {
372 out.push('_');
373 out.push(c.to_ascii_lowercase());
374 } else {
375 out.push(c);
376 }
377 }
378 out
379}
380
381/// Seconds a caller is told to wait when the store is busy.
382const BUSY_RETRY_AFTER: u64 = 5;
383
384/// Calls `target[method](...args)` on namespace `namespace`'s binding, for
385/// the repository at `key`. `retry`: whether a failure that may pass is
386/// tried again (reads and credentials only).
387async fn invoke(
388 namespace: &str,
389 key: &str,
390 target: &Target,
391 method: &str,
392 args: &[JsValue],
393 retry: bool,
394) -> std::result::Result<JsValue, StoreError> {
395 let meter = meter_of(method);
396 let health = target.health_name(namespace);
397 let namespace = health.as_str();
398 // A read-only fallback refuses writes before asking (fallback.rs).
399 if let Target::Fallback { settings, repo, .. } = target
400 && !settings.writes
401 {
402 let values: Vec<serde_json::Value> = args.iter().map(|arg| js::from_js(arg).unwrap_or(serde_json::Value::Null)).collect();
403 if fallback::writes(repo.as_deref(), method, &values) {
404 return Err(StoreError {
405 thrown: Thrown { code: Some("READ_ONLY".to_owned()), message: format!("{method} refused: the git store is read-only") },
406 busy: Some(Busy::read_only()),
407 });
408 }
409 }
410 let mut attempt = 0;
411 loop {
412 let now = g1t_kit::now_ms();
413 let admit = resilience::with_breaker(namespace, |breaker| breaker.admit(now));
414 if let Admit::Wait(ms) = admit {
415 meters::record_health(namespace, Outcome::Rejected, 0);
416 return Err(StoreError {
417 thrown: Thrown { code: None, message: format!("{method} not asked: the git store has been failing") },
418 busy: Some(Busy { rate_limited: false, retry_after: resilience::seconds(ms).max(BUSY_RETRY_AFTER), read_only: false }),
419 });
420 }
421 // Calls on Artifacts are metered; the fallback store costs nothing
422 // per call.
423 if !target.is_fallback() {
424 meters::record(&meter, key, 0, 0);
425 }
426 let called = dispatch(target, method, args).await;
427 let ms = g1t_kit::now_ms().saturating_sub(now);
428 match called {
429 Ok(value) => {
430 resilience::with_breaker(namespace, |breaker| breaker.succeeded());
431 meters::record_health(namespace, Outcome::Ok, ms);
432 return Ok(value);
433 }
434 Err(thrown) => {
435 let failure = resilience::classify(thrown.code.as_deref(), &thrown.message);
436 if failure == Failure::Permanent {
437 // An answer (NOT_FOUND, ALREADY_EXISTS): the store is up.
438 resilience::with_breaker(namespace, |breaker| breaker.succeeded());
439 meters::record_health(namespace, Outcome::Ok, ms);
440 return Err(StoreError { thrown, busy: None });
441 }
442 if retry && resilience::retry(failure, attempt) {
443 let wait = resilience::backoff_ms(failure, attempt, worker::js_sys::Math::random());
444 worker::Delay::from(std::time::Duration::from_millis(wait)).await;
445 attempt += 1;
446 continue;
447 }
448 resilience::with_breaker(namespace, |breaker| breaker.failed(failure, g1t_kit::now_ms()));
449 let outcome = if failure == Failure::RateLimited { Outcome::RateLimited } else { Outcome::Failed };
450 meters::record_health(namespace, outcome, ms);
451 worker::console_error!("git store {namespace}: {method} for {key} failed: {thrown}");
452 return Err(StoreError {
453 thrown,
454 busy: Some(Busy { rate_limited: failure == Failure::RateLimited, retry_after: BUSY_RETRY_AFTER, read_only: false }),
455 });
456 }
457 }
458 }
459}
460
461/// Makes one call: on the binding, or as a request to the fallback store.
462async fn dispatch(target: &Target, method: &str, args: &[JsValue]) -> std::result::Result<JsValue, Thrown> {
463 let (settings, namespace, repo) = match target {
464 Target::Js(value) => return js::call(value, method, args).await,
465 Target::Fallback { settings, namespace, repo } => (settings, namespace, repo),
466 };
467 let values: Vec<serde_json::Value> = args.iter().map(|arg| js::from_js(arg).unwrap_or(serde_json::Value::Null)).collect();
468 let route = fallback::route(namespace, repo.as_deref(), method, &values)
469 .map_err(|refused| Thrown { code: Some(refused.code.to_owned()), message: refused.message })?;
470 let unreachable = |error: worker::Error| Thrown { code: None, message: format!("the fallback store could not be reached: {error}") };
471 let headers = worker::Headers::new();
472 headers.set("x-gitstore-secret", &settings.secret).map_err(unreachable)?;
473 let mut init = worker::RequestInit::new();
474 init.with_method(match route.method {
475 "POST" => worker::Method::Post,
476 "DELETE" => worker::Method::Delete,
477 _ => worker::Method::Get,
478 });
479 if let Some(body) = &route.body {
480 headers.set("content-type", "application/json").map_err(unreachable)?;
481 init.with_body(Some(JsValue::from_str(&body.to_string())));
482 }
483 init.with_headers(headers);
484 let request = worker::Request::new_with_init(&format!("{}{}", settings.url, route.path), &init).map_err(unreachable)?;
485 let mut response = worker::Fetch::Request(request).send().await.map_err(unreachable)?;
486 let status = response.status_code();
487 let body = response.bytes().await.map_err(unreachable)?;
488 match fallback::answer(&route, status, body) {
489 fallback::Answer::Json(value) => js::to_js(&value).map_err(|error| Thrown { code: None, message: error.to_string() }),
490 fallback::Answer::Bytes(bytes) => Ok(Uint8Array::from(bytes.as_slice()).into()),
491 fallback::Answer::Null => Ok(JsValue::NULL),
492 fallback::Answer::Error { code, message } => Err(Thrown { code, message }),
493 }
494}
495
496/// A credential as isolates share it, sealed (see shared.rs): with when it
497/// was made, so that one shared is reused no longer than one kept here.
498#[derive(Serialize, Deserialize)]
499struct SharedCredential {
500 remote: String,
501 token: String,
502 made: u64,
503}
504
505/// The shared cache's key for a credential: the store's key for the
506/// repository, the scope, and who it is for. (`cred2`: credentials kept
507/// before their lives differed by use are not read.)
508fn shared_key(key: &str, scope: Scope, using: Use) -> String {
509 format!("cred2:{key}:{}:{}", scope.as_str(), using.as_str())
510}
511
512/// A shared credential, if it was made less than its reuse window before
513/// `now`; with when it was made.
514fn shared_credential(bytes: &[u8], now: u64, using: Use) -> Option<(GitAccess, u64)> {
515 let kept: SharedCredential = serde_json::from_slice(bytes).ok()?;
516 (now.saturating_sub(kept.made) < using.reuse_ms()).then_some((
517 GitAccess {
518 remote: kept.remote,
519 token: kept.token,
520 },
521 kept.made,
522 ))
523}
524
525/// Credentials made a while ago, by repository, scope and use. Making one
526/// is a round trip to the store; reusing it saves that, and the store's
527/// lookup of the repository with it.
528#[derive(Default)]
529pub struct Credentials {
530 kept: HashMap<(String, Scope, Use), (GitAccess, u64)>,
531}
532
533impl Credentials {
534 /// One made for `key`, `scope` and `using` within its reuse window of `now`.
535 pub fn get(&self, key: &str, scope: Scope, using: Use, now: u64) -> Option<GitAccess> {
536 self.kept
537 .get(&(key.to_owned(), scope, using))
538 .filter(|(_, made)| now.saturating_sub(*made) < using.reuse_ms())
539 .map(|(access, _)| access.clone())
540 }
541
542 pub fn keep(&mut self, key: &str, scope: Scope, using: Use, access: GitAccess, made: u64, now: u64) {
543 // Expired ones go first, so the map stays as small as the isolate's
544 // recent repositories.
545 self.kept
546 .retain(|(_, _, kept_use), (_, at)| now.saturating_sub(*at) < kept_use.reuse_ms());
547 self.kept.insert((key.to_owned(), scope, using), (access, made));
548 }
549
550 pub fn forget(&mut self, key: &str) {
551 self.kept.retain(|(kept, _, _), _| kept != key);
552 }
553}
554
555thread_local! {
556 static CREDENTIALS: RefCell<Credentials> = RefCell::new(Credentials::default());
557}
558
559/// A credential kept in this isolate, else one another isolate shared.
560async fn kept(shared: Option<&crate::shared::Shared>, key: &str, scope: Scope, using: Use) -> Option<(GitAccess, Kept)> {
561 let now = g1t_kit::now_ms();
562 if let Some(access) = CREDENTIALS.with(|kept| kept.borrow().get(key, scope, using, now)) {
563 return Some((access, Kept::Isolate));
564 }
565 let bytes = shared?.get(&shared_key(key, scope, using)).await?;
566 let (access, made) = shared_credential(&bytes, now, using)?;
567 CREDENTIALS.with(|kept| kept.borrow_mut().keep(key, scope, using, access.clone(), made, now));
568 Some((access, Kept::Shared))
569}
570
571/// Keeps a credential just made here, and shares it.
572async fn keep(shared: Option<&crate::shared::Shared>, key: &str, scope: Scope, using: Use, access: &GitAccess) {
573 let now = g1t_kit::now_ms();
574 CREDENTIALS.with(|kept| kept.borrow_mut().keep(key, scope, using, access.clone(), now, now));
575 if let Some(shared) = shared {
576 let value = SharedCredential {
577 remote: access.remote.clone(),
578 token: access.token.clone(),
579 made: now,
580 };
581 if let Ok(bytes) = serde_json::to_vec(&value) {
582 shared.put(&shared_key(key, scope, using), &bytes, using.reuse_ms() / 1000).await;
583 }
584 }
585}
586
587impl GitStore for ArtifactsStore {
588 type Repo = ArtifactsRepo;
589
590 async fn kept_access(&self, key: &str, scope: Scope) -> Option<(GitAccess, Kept)> {
591 kept(self.shared.as_deref(), &self.cred_key(key), scope, Use::Internal).await
592 }
593
594 async fn mint_access(&self, key: &str, scope: Scope) -> Result<GitAccess> {
595 let repo = self.open(key).await?;
596 let access = repo.mint(scope, Use::Internal).await?;
597 keep(self.shared.as_deref(), &self.cred_key(key), scope, Use::Internal, &access).await;
598 Ok(access)
599 }
600
601 async fn handout(&self, key: &str, scope: Scope) -> Result<GitAccess> {
602 let cred_key = self.cred_key(key);
603 if let Some((access, _)) = kept(self.shared.as_deref(), &cred_key, scope, Use::Handout).await {
604 return Ok(access);
605 }
606 let access = self.open(key).await?.mint(scope, Use::Handout).await?;
607 keep(self.shared.as_deref(), &cred_key, scope, Use::Handout, &access).await;
608 Ok(access)
609 }
610
611 async fn forget_access(&self, key: &str) {
612 // Both stores' credentials: whichever serves the key now.
613 let names = [cred_key(key, false), cred_key(key, true)];
614 CREDENTIALS.with(|kept| {
615 let mut kept = kept.borrow_mut();
616 for name in &names {
617 kept.forget(name);
618 }
619 });
620 if let Some(shared) = &self.shared {
621 let keys: Vec<String> = names
622 .iter()
623 .flat_map(|name| {
624 [Scope::Read, Scope::Write]
625 .into_iter()
626 .flat_map(move |scope| [Use::Internal, Use::Handout].map(|using| shared_key(name, scope, using)))
627 })
628 .collect();
629 futures_util::future::join_all(keys.iter().map(|shared_key| shared.delete(shared_key))).await;
630 }
631 }
632
633 async fn create(&self, key: &str, description: Option<&str>, default_branch: &str) -> Result<()> {
634 let (namespace, name) = locate(key);
635 let options = js::to_js(&serde_json::json!({
636 "description": description,
637 "setDefaultBranch": default_branch,
638 }))?;
639 match invoke(&namespace, key, self.binding(&namespace)?, "create", &[name.as_str().into(), options], true).await {
640 // Left behind by an earlier failed attempt; adopt it.
641 Err(failed) if !failed.is("ALREADY_EXISTS") => Err(failed.into()),
642 _ => Ok(()),
643 }
644 }
645
646 async fn delete(&self, key: &str) -> Result<()> {
647 let (namespace, name) = locate(key);
648 // Nothing is forgotten while the store refuses to delete.
649 if self.writable(&namespace) {
650 self.forget_access(key).await;
651 }
652 match invoke(&namespace, key, self.binding(&namespace)?, "delete", &[name.as_str().into()], true).await {
653 // Gone already: an earlier purge got this far.
654 Err(failed) if !failed.is("NOT_FOUND") => Err(failed.into()),
655 _ => Ok(()),
656 }
657 }
658
659 async fn open(&self, key: &str) -> Result<ArtifactsRepo> {
660 let (namespace, name) = locate(key);
661 let binding = self.binding(&namespace)?.clone();
662 Ok(ArtifactsRepo {
663 handle: RefCell::new(None),
664 cred_key: cred_key(key, binding.is_fallback()),
665 binding,
666 key: key.to_owned(),
667 name,
668 namespace,
669 shared: self.shared.clone(),
670 refs_version: None,
671 })
672 }
673
674 fn namespaces(&self) -> Vec<String> {
675 self.namespaces.iter().map(|namespace| namespace.name.clone()).collect()
676 }
677
678 fn default_namespace(&self) -> String {
679 DEFAULT_NS.with(|ns| ns.borrow().clone())
680 }
681
682 fn on_fallback(&self, key: &str) -> bool {
683 let (namespace, _) = locate(key);
684 self.fallback_of(&namespace).is_some()
685 }
686
687 fn writable(&self, namespace: &str) -> bool {
688 self.fallback_of(namespace).is_none_or(|settings| settings.writes)
689 }
690}
691
692/// A handle to one repository in the store. On Artifacts it is an RPC
693/// stub, so it is released when dropped.
694pub struct ArtifactsRepo {
695 /// The store's handle, asked for (`get`) on the first call that needs
696 /// the store: an answer from a cache, or a fetch over git with a kept
697 /// credential, never costs a `get`.
698 handle: RefCell<Option<Target>>,
699 /// The namespace's binding, for that `get`.
700 binding: Target,
701 /// The repository's store key, which scopes its cached objects.
702 key: String,
703 /// What its credentials are kept under (`ArtifactsStore::cred_key`).
704 cred_key: String,
705 /// Its name in its namespace.
706 name: String,
707 namespace: String,
708 shared: Option<Rc<crate::shared::Shared>>,
709 /// See [`GitRepo::at_refs_version`].
710 refs_version: Option<u64>,
711}
712
713/// Where cached git objects live. Trees and blobs are named by their
714/// content, so a cached one is never stale; each is kept under its own
715/// repository's key, so a repository only ever finds its own objects.
716const OBJECT_CACHE: &str = "https://objects.g1t.internal/";
717/// Blobs and files larger than this are not cached.
718const MAX_CACHED_BLOB: usize = 1024 * 1024;
719const OBJECT_MAX_AGE: &str = "public, max-age=31536000, immutable";
720/// Answers kept under a refs version: until the version moves, and no
721/// longer than this, which bounds how stale one can be should a change
722/// ever fail to move it.
723const VERSIONED_MAX_AGE: &str = "public, max-age=300";
724
725/// Whether a ref is a full commit hash (SHA-1 or SHA-256), whose history
726/// can be kept for good.
727pub fn is_commit_hash(git_ref: &str) -> bool {
728 (git_ref.len() == 40 || git_ref.len() == 64) && git_ref.bytes().all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase())
729}
730
731/// Where a read is kept: under the object it names for good, under the
732/// refs version for a name that can move, or nowhere.
733#[derive(Debug, PartialEq, Eq)]
734pub enum CacheKey {
735 Forever(String),
736 Versioned(String),
737}
738
739/// The cache key for `log(git_ref, limit)`.
740pub fn log_key(git_ref: &str, limit: u32, version: Option<u64>) -> Option<CacheKey> {
741 if is_commit_hash(git_ref) {
742 return Some(CacheKey::Forever(format!("log/{git_ref}-{limit}")));
743 }
744 version.map(|version| CacheKey::Versioned(format!("vlog/{version}/{}-{limit}", g1t_secrets::sha256_hex(git_ref))))
745}
746
747/// The cache key for `read_file(git_ref, path)`.
748pub fn file_key(git_ref: &str, path: &str, version: Option<u64>) -> Option<CacheKey> {
749 let path = g1t_secrets::sha256_hex(path);
750 if is_commit_hash(git_ref) {
751 return Some(CacheKey::Forever(format!("file/{git_ref}/{path}")));
752 }
753 version.map(|version| CacheKey::Versioned(format!("vfile/{version}/{}/{path}", g1t_secrets::sha256_hex(git_ref))))
754}
755
756/// The cache key for the branch list.
757pub fn branches_key(version: Option<u64>) -> Option<CacheKey> {
758 version.map(|version| CacheKey::Versioned(format!("branches/{version}")))
759}
760
761/// Objects named by their content, kept in the isolate ahead of the Cache
762/// API, oldest out first past `MEMORY_CACHE_BYTES`. They never go stale,
763/// and each is under its repository's key.
764const MEMORY_CACHE_BYTES: usize = 16 * 1024 * 1024;
765
766#[derive(Default)]
767struct MemoryCache {
768 entries: HashMap<String, Rc<Vec<u8>>>,
769 order: std::collections::VecDeque<String>,
770 bytes: usize,
771}
772
773impl MemoryCache {
774 fn get(&self, url: &str) -> Option<Vec<u8>> {
775 self.entries.get(url).map(|bytes| bytes.as_ref().clone())
776 }
777
778 fn put(&mut self, url: String, bytes: &[u8]) {
779 if bytes.len() > MEMORY_CACHE_BYTES / 16 || self.entries.contains_key(&url) {
780 return;
781 }
782 self.bytes += bytes.len();
783 self.entries.insert(url.clone(), Rc::new(bytes.to_vec()));
784 self.order.push_back(url);
785 while self.bytes > MEMORY_CACHE_BYTES {
786 let Some(oldest) = self.order.pop_front() else { break };
787 if let Some(gone) = self.entries.remove(&oldest) {
788 self.bytes -= gone.len();
789 }
790 }
791 }
792}
793
794thread_local! {
795 static MEMORY: RefCell<MemoryCache> = RefCell::new(MemoryCache::default());
796}
797
798impl ArtifactsRepo {
799 fn cache_url(&self, path: &str) -> String {
800 format!("{OBJECT_CACHE}{}/{path}", self.key)
801 }
802
803 /// A kept answer: from the isolate for one kept for good, else the
804 /// Cache API. Each look is metered (`cache.memory_hit`, `cache.edge_hit`,
805 /// `cache.miss`), so the usage check shows which cache answers.
806 async fn cached_at(&self, path: &str, forever: bool) -> Option<Vec<u8>> {
807 let url = self.cache_url(path);
808 if forever && let Some(bytes) = MEMORY.with(|memory| memory.borrow().get(&url)) {
809 meters::record("cache.memory_hit", &self.key, 0, bytes.len() as u64);
810 return Some(bytes);
811 }
812 let found = match worker::Cache::default().get(url.clone(), false).await {
813 Ok(Some(mut response)) => response.bytes().await.ok(),
814 _ => None,
815 };
816 match &found {
817 Some(bytes) => {
818 meters::record("cache.edge_hit", &self.key, 0, bytes.len() as u64);
819 if forever {
820 MEMORY.with(|memory| memory.borrow_mut().put(url, bytes));
821 }
822 }
823 None => meters::record("cache.miss", &self.key, 0, 0),
824 }
825 found
826 }
827
828 async fn cached(&self, kind: &str, hash: &str) -> Option<Vec<u8>> {
829 self.cached_at(&format!("{kind}/{hash}"), true).await
830 }
831
832 async fn keep_at(&self, path: &str, bytes: Vec<u8>, max_age: &str) {
833 if max_age == OBJECT_MAX_AGE {
834 MEMORY.with(|memory| memory.borrow_mut().put(self.cache_url(path), &bytes));
835 }
836 let Ok(mut response) = worker::Response::from_bytes(bytes) else {
837 return;
838 };
839 let _ = response.headers_mut().set("cache-control", max_age);
840 let _ = worker::Cache::default().put(self.cache_url(path), response).await;
841 }
842
843 /// Keeps an object for next time. A failure only costs a later read.
844 async fn keep(&self, kind: &str, hash: &str, bytes: Vec<u8>) {
845 self.keep_at(&format!("{kind}/{hash}"), bytes, OBJECT_MAX_AGE).await;
846 }
847
848 async fn get_key(&self, key: &CacheKey) -> Option<Vec<u8>> {
849 match key {
850 CacheKey::Forever(path) => self.cached_at(path, true).await,
851 CacheKey::Versioned(path) => self.cached_at(path, false).await,
852 }
853 }
854
855 async fn put_key(&self, key: &CacheKey, bytes: Vec<u8>) {
856 match key {
857 CacheKey::Forever(path) => self.keep_at(path, bytes, OBJECT_MAX_AGE).await,
858 CacheKey::Versioned(path) => self.keep_at(path, bytes, VERSIONED_MAX_AGE).await,
859 }
860 }
861
862 async fn call(&self, method: &str, args: &[JsValue], retry: bool) -> std::result::Result<JsValue, StoreError> {
863 let handle = self.handle().await?;
864 invoke(&self.namespace, &self.key, &handle, method, args, retry).await
865 }
866
867 /// The store's handle, asked for the first time it is needed.
868 async fn handle(&self) -> std::result::Result<Target, StoreError> {
869 if let Some(handle) = self.handle.borrow().as_ref() {
870 return Ok(handle.clone());
871 }
872 let found = invoke(&self.namespace, &self.key, &self.binding, "get", &[self.name.as_str().into()], true).await?;
873 let handle = match &self.binding {
874 Target::Js(_) => Target::Js(found),
875 // The fallback store said the repository is there.
876 Target::Fallback { settings, namespace, .. } => Target::Fallback {
877 settings: settings.clone(),
878 namespace: namespace.clone(),
879 repo: Some(self.name.clone()),
880 },
881 };
882 *self.handle.borrow_mut() = Some(handle.clone());
883 Ok(handle)
884 }
885
886 /// A new credential from the store. Its remote is worked out from the
887 /// key once this isolate knows where the namespace's remotes start;
888 /// until then the store is asked (`info()`) alongside the token. The
889 /// fallback store's remotes are known from its address.
890 pub async fn mint(&self, scope: Scope, using: Use) -> Result<GitAccess> {
891 let args = [scope.as_str().into(), using.ttl_seconds().into()];
892 if let Target::Fallback { settings, .. } = &self.binding {
893 let token: RawToken = js::from_js(&self.call("createToken", &args, true).await?)?;
894 return Ok(GitAccess { remote: settings.remote(&self.namespace, &self.name), token: token.plaintext });
895 }
896 let prefix = REMOTE_PREFIX.with(|prefixes| prefixes.borrow().get(&self.namespace).cloned());
897 if let Some(prefix) = prefix {
898 let token: RawToken = js::from_js(&self.call("createToken", &args, true).await?)?;
899 return Ok(GitAccess { remote: remote_from(&prefix, &self.name), token: token.plaintext });
900 }
901 self.handle().await?;
902 let (info, token) = futures_util::future::join(self.call("info", &[], true), self.call("createToken", &args, true)).await;
903 let info: RawInfo = js::from_js(&info?)?;
904 let token: RawToken = js::from_js(&token?)?;
905 match learn_prefix(&info.remote, &self.name) {
906 Some(prefix) => REMOTE_PREFIX.with(|prefixes| {
907 prefixes.borrow_mut().insert(self.namespace.clone(), prefix);
908 }),
909 None => worker::console_error!("the git store's remote {} does not end in {}.git", info.remote, self.name),
910 }
911 Ok(GitAccess { remote: info.remote, token: token.plaintext })
912 }
913}
914
915impl Drop for ArtifactsRepo {
916 fn drop(&mut self) {
917 let symbol = js::get(&worker::js_sys::global(), "Symbol");
918 let dispose = js::get(&symbol, "dispose");
919 let Some(Target::Js(handle)) = self.handle.borrow_mut().take() else { return };
920 if let Ok(function) = Reflect::get(&handle, &dispose).and_then(|value| value.dyn_into::<worker::js_sys::Function>()) {
921 let _ = function.call0(&handle);
922 }
923 }
924}
925
926#[derive(Deserialize)]
927#[serde(rename_all = "camelCase")]
928struct RawCommit {
929 hash: String,
930 tree_hash: String,
931 message: String,
932 author: Signature,
933 parents: Vec<String>,
934 /// Seconds since the epoch.
935 authored_at: u64,
936}
937
938#[derive(Deserialize)]
939struct RawEntry {
940 name: String,
941 hash: String,
942 #[serde(rename = "type")]
943 kind: EntryKind,
944}
945
946#[derive(Deserialize)]
947struct RawInfo {
948 remote: String,
949}
950
951#[derive(Deserialize)]
952struct RawToken {
953 plaintext: String,
954}
955
956/// The bytes of a `Blob` (or of the bytes the fallback store sent), or
957/// `None` for null.
958async fn blob_bytes(blob: JsValue) -> Result<Option<Vec<u8>>> {
959 if blob.is_null() || blob.is_undefined() {
960 return Ok(None);
961 }
962 if let Some(bytes) = blob.dyn_ref::<Uint8Array>() {
963 return Ok(Some(bytes.to_vec()));
964 }
965 let buffer = js::call(&blob, "arrayBuffer", &[]).await?;
966 Ok(Some(Uint8Array::new(&buffer).to_vec()))
967}
968
969impl GitRepo for ArtifactsRepo {
970 /// One made a while ago, here or in another isolate, else a new one.
971 async fn access(&self, scope: Scope) -> Result<GitAccess> {
972 if let Some((access, _)) = kept(self.shared.as_deref(), &self.cred_key, scope, Use::Internal).await {
973 return Ok(access);
974 }
975 let access = self.mint(scope, Use::Internal).await?;
976 keep(self.shared.as_deref(), &self.cred_key, scope, Use::Internal, &access).await;
977 Ok(access)
978 }
979
980 async fn branches(&self) -> Result<Vec<Branch>> {
981 let key = branches_key(self.refs_version);
982 if let Some(key) = &key
983 && let Some(bytes) = self.get_key(key).await
984 && let Ok(branches) = serde_json::from_slice::<Vec<Branch>>(&bytes)
985 {
986 return Ok(branches);
987 }
988 let branches = crate::refs::branches(&self.access(Scope::Read).await?).await?;
989 if let (Some(key), Ok(bytes)) = (&key, serde_json::to_vec(&branches)) {
990 self.put_key(key, bytes).await;
991 }
992 Ok(branches)
993 }
994
995 async fn log(&self, git_ref: &str, limit: u32) -> Result<Vec<Commit>> {
996 // History from a commit never changes, so a log asked for by hash is
997 // kept like an object: walking it is a read per commit. One asked
998 // for by a branch's name is kept until the branch can have moved.
999 let key = log_key(git_ref, limit, self.refs_version);
1000 if let Some(key) = &key
1001 && let Some(bytes) = self.get_key(key).await
1002 && let Ok(commits) = serde_json::from_slice::<Vec<Commit>>(&bytes)
1003 {
1004 return Ok(commits);
1005 }
1006 let options = js::to_js(&serde_json::json!({ "ref": git_ref, "limit": limit }))?;
1007 let raw: Vec<RawCommit> = js::from_js(&self.call("log", &[options], true).await?)?;
1008 let commits: Vec<Commit> = raw
1009 .into_iter()
1010 .map(|commit| Commit {
1011 hash: commit.hash,
1012 tree_hash: commit.tree_hash,
1013 message: commit.message,
1014 author: commit.author,
1015 parents: commit.parents,
1016 authored_at: rfc3339(commit.authored_at * 1000),
1017 })
1018 .collect();
1019 // An unknown ref logs nothing; that is not kept, in case it arrives.
1020 if !commits.is_empty()
1021 && let Ok(bytes) = serde_json::to_vec(&commits)
1022 {
1023 if let Some(key) = &key {
1024 self.put_key(key, bytes.clone()).await;
1025 }
1026 // The same history, by the commit the name led to.
1027 if !is_commit_hash(git_ref)
1028 && let Some(CacheKey::Forever(path)) = log_key(&commits[0].hash, limit, None)
1029 {
1030 self.keep_at(&path, bytes, OBJECT_MAX_AGE).await;
1031 }
1032 }
1033 Ok(commits)
1034 }
1035
1036 async fn parents(&self, commit_hash: &str) -> Result<Option<Vec<String>>> {
1037 // A commit never changes.
1038 if let Some(bytes) = self.cached("commit", commit_hash).await
1039 && let Ok(parents) = serde_json::from_slice::<Vec<String>>(&bytes)
1040 {
1041 return Ok(Some(parents));
1042 }
1043 let commit: Option<RawCommit> = js::from_js(&self.call("readCommit", &[commit_hash.into()], true).await?)?;
1044 let parents = commit.map(|commit| commit.parents);
1045 if let Some(parents) = &parents
1046 && let Ok(bytes) = serde_json::to_vec(parents)
1047 {
1048 self.keep("commit", commit_hash, bytes).await;
1049 }
1050 Ok(parents)
1051 }
1052
1053 async fn read_tree(&self, tree_hash: &str) -> Result<Option<Vec<TreeEntry>>> {
1054 if let Some(bytes) = self.cached("tree", tree_hash).await
1055 && let Ok(entries) = serde_json::from_slice::<Vec<TreeEntry>>(&bytes)
1056 {
1057 return Ok(Some(entries));
1058 }
1059 let entries: Option<Vec<RawEntry>> = js::from_js(&self.call("readTree", &[tree_hash.into()], true).await?)?;
1060 let entries: Option<Vec<TreeEntry>> = entries.map(|entries| {
1061 entries
1062 .into_iter()
1063 .map(|entry| TreeEntry {
1064 name: entry.name,
1065 hash: entry.hash,
1066 kind: entry.kind,
1067 })
1068 .collect()
1069 });
1070 if let Some(entries) = &entries
1071 && let Ok(bytes) = serde_json::to_vec(entries)
1072 {
1073 self.keep("tree", tree_hash, bytes).await;
1074 }
1075 Ok(entries)
1076 }
1077
1078 async fn read_blob(&self, blob_hash: &str) -> Result<Option<Vec<u8>>> {
1079 if let Some(bytes) = self.cached("blob", blob_hash).await {
1080 return Ok(Some(bytes));
1081 }
1082 let bytes = blob_bytes(self.call("readBlob", &[blob_hash.into()], true).await?).await?;
1083 if let Some(bytes) = &bytes {
1084 meters::record_bytes("binding.read_blob", &self.key, 0, bytes.len() as u64);
1085 }
1086 if let Some(bytes) = bytes.as_ref().filter(|bytes| bytes.len() <= MAX_CACHED_BLOB) {
1087 self.keep("blob", blob_hash, bytes.clone()).await;
1088 }
1089 Ok(bytes)
1090 }
1091
1092 async fn read_file(&self, git_ref: &str, path: &str) -> Result<Option<Vec<u8>>> {
1093 let key = file_key(git_ref, path, self.refs_version);
1094 if let Some(key) = &key
1095 && let Some(bytes) = self.get_key(key).await
1096 {
1097 return Ok(Some(bytes));
1098 }
1099 let args = js::to_js(&serde_json::json!({ "ref": git_ref, "path": path }))?;
1100 let bytes = blob_bytes(self.call("readFile", &[args], true).await?).await?;
1101 if let Some(bytes) = &bytes {
1102 meters::record_bytes("binding.read_file", &self.key, 0, bytes.len() as u64);
1103 }
1104 if let (Some(key), Some(bytes)) = (&key, bytes.as_ref().filter(|bytes| bytes.len() <= MAX_CACHED_BLOB)) {
1105 self.put_key(key, bytes.clone()).await;
1106 }
1107 Ok(bytes)
1108 }
1109
1110 async fn fork(&self, target_key: &str) -> Result<()> {
1111 let (namespace, name) = locate(target_key);
1112 if namespace != self.namespace {
1113 return Err(worker::Error::RustError(format!(
1114 "a fork stays in its repository's namespace: {target_key} is not in {}",
1115 self.namespace
1116 )));
1117 }
1118 let options = js::to_js(&serde_json::json!({ "defaultBranchOnly": true }))?;
1119 match self.call("fork", &[name.as_str().into(), options], false).await {
1120 Err(failed) if !failed.is("ALREADY_EXISTS") => Err(failed.into()),
1121 _ => Ok(()),
1122 }
1123 }
1124
1125 fn at_refs_version(&mut self, version: Option<u64>) {
1126 // The fallback store holds what the last backup held, which may be
1127 // behind what was kept under the version: nothing is kept for it.
1128 self.refs_version = if self.binding.is_fallback() { None } else { version };
1129 }
1130}
1131
1132#[cfg(test)]
1133mod tests {
1134 use super::*;
1135
1136 fn access(token: &str) -> GitAccess {
1137 GitAccess {
1138 remote: "https://store.example/acme--rocket.git".to_owned(),
1139 token: token.to_owned(),
1140 }
1141 }
1142
1143 #[test]
1144 fn internal_credentials_live_an_hour_and_are_reused_for_fifty_minutes() {
1145 assert_eq!(Use::Internal.ttl_seconds(), 3_600);
1146 assert_eq!(Use::Internal.reuse_ms(), 50 * 60 * 1000);
1147 // Handed out: five minutes, reused three, so at least two are left.
1148 assert_eq!(Use::Handout.ttl_seconds(), 300);
1149 assert_eq!(Use::Handout.reuse_ms(), 180_000);
1150 assert_eq!(CREDENTIAL_LIFE_MS, 300_000);
1151 for using in [Use::Internal, Use::Handout] {
1152 assert!(u64::from(using.ttl_seconds()) * 1000 - using.reuse_ms() >= 120_000);
1153 }
1154 }
1155
1156 #[test]
1157 fn a_credential_is_reused_only_while_it_has_time_left() {
1158 let mut kept = Credentials::default();
1159 kept.keep("acme--rocket", Scope::Read, Use::Internal, access("r1"), 1_000, 1_000);
1160 assert_eq!(kept.get("acme--rocket", Scope::Read, Use::Internal, 1_000).unwrap().token, "r1");
1161 let last = 1_000 + INTERNAL_REUSE_MS - 1;
1162 assert_eq!(kept.get("acme--rocket", Scope::Read, Use::Internal, last).unwrap().token, "r1");
1163 assert!(kept.get("acme--rocket", Scope::Read, Use::Internal, last + 1).is_none());
1164 }
1165
1166 #[test]
1167 fn a_credential_is_kept_for_its_own_repository_scope_and_use() {
1168 let mut kept = Credentials::default();
1169 kept.keep("acme--rocket", Scope::Read, Use::Internal, access("r1"), 1_000, 1_000);
1170 // A read credential never stands in for a write one.
1171 assert!(kept.get("acme--rocket", Scope::Write, Use::Internal, 1_000).is_none());
1172 assert!(kept.get("acme--booster", Scope::Read, Use::Internal, 1_000).is_none());
1173 // An hour-long credential is never handed out.
1174 assert!(kept.get("acme--rocket", Scope::Read, Use::Handout, 1_000).is_none());
1175 kept.keep("acme--rocket", Scope::Read, Use::Handout, access("h1"), 1_000, 1_000);
1176 assert_eq!(kept.get("acme--rocket", Scope::Read, Use::Handout, 1_000).unwrap().token, "h1");
1177 assert!(kept.get("acme--rocket", Scope::Read, Use::Handout, 1_000 + HANDOUT_REUSE_MS).is_none());
1178 assert!(kept.get("acme--rocket", Scope::Read, Use::Internal, 1_000 + HANDOUT_REUSE_MS).is_some());
1179 }
1180
1181 #[test]
1182 fn a_shared_credential_is_reused_only_in_its_own_window() {
1183 let value = serde_json::to_vec(&SharedCredential {
1184 remote: "https://store.example/acme--rocket.git".to_owned(),
1185 token: "r1".to_owned(),
1186 made: 10_000,
1187 })
1188 .unwrap();
1189 let (access, made) = shared_credential(&value, 10_000 + INTERNAL_REUSE_MS - 1, Use::Internal).unwrap();
1190 assert_eq!(access.token, "r1");
1191 // Kept here only for what is left of its window, not a new one.
1192 assert_eq!(made, 10_000);
1193 assert!(shared_credential(&value, 10_000 + INTERNAL_REUSE_MS, Use::Internal).is_none());
1194 assert!(shared_credential(&value, 10_000 + HANDOUT_REUSE_MS, Use::Handout).is_none());
1195 assert!(shared_credential(b"not json", 10_000, Use::Internal).is_none());
1196 // Each repository, scope and use has its own key, and none is read
1197 // from before uses differed.
1198 assert_eq!(shared_key("acme--rocket", Scope::Read, Use::Internal), "cred2:acme--rocket:read:internal");
1199 assert_ne!(shared_key("acme--rocket", Scope::Read, Use::Internal), shared_key("acme--rocket", Scope::Write, Use::Internal));
1200 assert_ne!(shared_key("acme--rocket", Scope::Read, Use::Internal), shared_key("acme--rocket", Scope::Read, Use::Handout));
1201 }
1202
1203 #[test]
1204 fn a_shared_credential_kept_here_expires_with_the_original() {
1205 let mut kept = Credentials::default();
1206 // Made at 1_000 elsewhere, found here at 100_000.
1207 kept.keep("acme--rocket", Scope::Read, Use::Internal, access("r1"), 1_000, 100_000);
1208 assert!(kept.get("acme--rocket", Scope::Read, Use::Internal, 100_000).is_some());
1209 assert!(kept.get("acme--rocket", Scope::Read, Use::Internal, 1_000 + INTERNAL_REUSE_MS).is_none());
1210 }
1211
1212 #[test]
1213 fn a_turned_down_credential_is_forgotten_and_old_ones_are_dropped() {
1214 let mut kept = Credentials::default();
1215 kept.keep("acme--rocket", Scope::Read, Use::Internal, access("r1"), 1_000, 1_000);
1216 kept.keep("acme--rocket", Scope::Write, Use::Handout, access("w1"), 1_000, 1_000);
1217 kept.keep("acme--booster", Scope::Read, Use::Internal, access("b1"), 1_000, 1_000);
1218 kept.forget("acme--rocket");
1219 assert!(kept.get("acme--rocket", Scope::Read, Use::Internal, 1_000).is_none());
1220 assert!(kept.get("acme--rocket", Scope::Write, Use::Handout, 1_000).is_none());
1221 assert!(kept.get("acme--booster", Scope::Read, Use::Internal, 1_000).is_some());
1222 // Keeping another later drops the expired one from the map.
1223 let later = 1_000 + INTERNAL_REUSE_MS;
1224 kept.keep("acme--other", Scope::Read, Use::Internal, access("o1"), later, later);
1225 assert_eq!(kept.kept.len(), 1);
1226 }
1227
1228 #[test]
1229 fn a_remote_is_worked_out_from_where_its_namespace_starts() {
1230 // As https://developers.cloudflare.com/artifacts/api/git-protocol/ documents.
1231 let remote = "https://1e6f2cffa3f445920836e8ebe446bb58.artifacts.cloudflare.net/git/g1t/acme--rocket.git";
1232 let prefix = learn_prefix(remote, "acme--rocket").unwrap();
1233 assert_eq!(prefix, "https://1e6f2cffa3f445920836e8ebe446bb58.artifacts.cloudflare.net/git/g1t/");
1234 assert_eq!(remote_from(&prefix, "pulls--pul_1"), prefix.clone() + "pulls--pul_1.git");
1235 assert_eq!(remote_from(&prefix, "acme--rocket"), remote);
1236 // A remote that does not end in the name teaches nothing.
1237 assert_eq!(learn_prefix(remote, "rocket"), None);
1238 assert_eq!(learn_prefix("https://x/acme--rocket", "acme--rocket"), None);
1239 // And back: a remote names its key.
1240 assert_eq!(key_from_remote(remote).as_deref(), Some("acme--rocket"));
1241 assert_eq!(
1242 key_from_remote("https://a.artifacts.cloudflare.net/git/g1t-us-1/acme--rocket.git").as_deref(),
1243 Some("g1t-us-1/acme--rocket")
1244 );
1245 assert_eq!(locate("g1t-us-1/acme--rocket"), ("g1t-us-1".to_owned(), "acme--rocket".to_owned()));
1246 assert_eq!(locate("acme--rocket"), ("g1t".to_owned(), "acme--rocket".to_owned()));
1247 }
1248
1249 #[test]
1250 fn the_fallback_stores_credentials_and_remotes_are_its_own() {
1251 assert_eq!(cred_key("acme--rocket", false), "acme--rocket");
1252 assert_eq!(cred_key("g1t-us-1/acme--rocket", true), "fallback:g1t-us-1/acme--rocket");
1253 // A credential Artifacts made is never handed out for the fallback
1254 // store, nor the reverse.
1255 assert_ne!(
1256 shared_key(&cred_key("acme--rocket", true), Scope::Write, Use::Internal),
1257 shared_key(&cred_key("acme--rocket", false), Scope::Write, Use::Internal)
1258 );
1259 // Its remotes name their keys as Artifacts' do.
1260 let settings = fallback::Settings::from_vars(Some("https://gitstore.example"), Some("0123456789abcdef"), Some("*"), None).unwrap();
1261 assert_eq!(key_from_remote(&settings.remote("g1t", "acme--rocket")).as_deref(), Some("acme--rocket"));
1262 assert_eq!(key_from_remote(&settings.remote("g1t-us-1", "pulls--pul_1")).as_deref(), Some("g1t-us-1/pulls--pul_1"));
1263 // Git requests to it count toward its own health, not Artifacts'.
1264 FALLBACK_BASE.with(|base| *base.borrow_mut() = Some(format!("{}/git/", settings.url)));
1265 assert_eq!(health_namespace(&settings.remote("g1t-us-1", "acme--rocket")), "g1t-us-1@fallback");
1266 assert_eq!(health_namespace("https://a.artifacts.cloudflare.net/git/g1t-us-1/acme--rocket.git"), "g1t-us-1");
1267 FALLBACK_BASE.with(|base| *base.borrow_mut() = None);
1268 }
1269
1270 #[test]
1271 fn the_memory_cache_drops_its_oldest_past_its_budget() {
1272 let mut cache = MemoryCache::default();
1273 let chunk = vec![7u8; MEMORY_CACHE_BYTES / 16];
1274 for n in 0..17 {
1275 cache.put(format!("k{n}"), &chunk);
1276 }
1277 // Sixteen chunks fit; the seventeenth pushed the first out.
1278 assert!(cache.get("k0").is_none());
1279 assert_eq!(cache.get("k16").map(|b| b.len()), Some(chunk.len()));
1280 assert!(cache.bytes <= MEMORY_CACHE_BYTES);
1281 // Too large to keep at all.
1282 cache.put("big".into(), &vec![0u8; MEMORY_CACHE_BYTES / 16 + 1]);
1283 assert!(cache.get("big").is_none());
1284 }
1285
1286 #[test]
1287 fn binding_methods_have_snake_case_meters() {
1288 assert_eq!(meter_of("createToken"), "binding.create_token");
1289 assert_eq!(meter_of("readBlob"), "binding.read_blob");
1290 assert_eq!(meter_of("get"), "binding.get");
1291 }
1292
1293 #[test]
1294 fn reads_by_name_are_kept_under_the_refs_version_and_by_hash_for_good() {
1295 let hash = "a".repeat(40);
1296 assert_eq!(log_key(&hash, 1, Some(3)), Some(CacheKey::Forever(format!("log/{hash}-1"))));
1297 assert_eq!(log_key(&hash, 1, None), Some(CacheKey::Forever(format!("log/{hash}-1"))));
1298 // A branch is kept only when the version is known.
1299 assert_eq!(log_key("main", 1, None), None);
1300 let v3 = log_key("main", 1, Some(3)).unwrap();
1301 assert!(matches!(&v3, CacheKey::Versioned(path) if path.starts_with("vlog/3/")));
1302 // A push moves the version and leaves the old answer behind.
1303 assert_ne!(Some(v3), log_key("main", 1, Some(4)));
1304 assert_ne!(log_key("main", 1, Some(3)), log_key("main", 50, Some(3)));
1305 assert_ne!(log_key("main", 1, Some(3)), log_key("dev", 1, Some(3)));
1306 // Odd branch names make a usable address.
1307 assert!(matches!(log_key("fix/#1 %20", 1, Some(3)), Some(CacheKey::Versioned(path)) if !path.contains('#') && !path.contains(' ')));
1308 assert_eq!(branches_key(None), None);
1309 assert_ne!(branches_key(Some(1)), branches_key(Some(2)));
1310 assert!(matches!(file_key(&hash, "src/main.rs", None), Some(CacheKey::Forever(_))));
1311 assert_eq!(file_key("main", "src/main.rs", None), None);
1312 assert_ne!(file_key("main", "a", Some(1)), file_key("main", "b", Some(1)));
1313 assert_ne!(file_key("main", "a", Some(1)), file_key("main", "a", Some(2)));
1314 }
1315
1316 #[test]
1317 fn only_full_lowercase_hashes_are_kept() {
1318 assert!(is_commit_hash(&"a".repeat(40)));
1319 assert!(is_commit_hash(&"0123456789abcdef".repeat(4)));
1320 assert!(!is_commit_hash("main"));
1321 assert!(!is_commit_hash(&"A".repeat(40)));
1322 assert!(!is_commit_hash(&"a".repeat(39)));
1323 }
1324}