Skip to content
Sign in

flagon-io/g1t

public
0
637 linesCodeBlameRaw

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R21//! The toolkit's credentials: a job's runtime token, the signed tokens of
2//! the blob URLs the toolkit uploads to and downloads from, and the claims
3//! of a job's OIDC token.
4//!
5//! - The runtime token (`ACTIONS_RUNTIME_TOKEN`) is a JSON Web Token, as
6//! the toolkit expects: `@actions/artifact` reads the run and job from
7//! its `scp` claim. It is signed (HS256) with the hash of the job's own
8//! token as the key, so it is checked against the job's row without a
9//! secret of its own, stops working when the job ends, and never lets
10//! its holder read the job's spec or report for it.
11//! - A blob token is a payload and its HMAC under a key derived from
12//! `ACTIONS_KEY`: which entry, which R2 upload (for an upload), and until
13//! when. The API serves `/actions/toolkit/blobs/{token}` with it.
14//! - OIDC claims follow GitHub's, so cloud providers' trust policies read
15//! them the same way. The API adds `iss`, `aud`, `jti` and the times,
16//! and signs.
17
18use base64::Engine;
19use base64::engine::general_purpose::URL_SAFE_NO_PAD;
20use g1t_actions::events::RunInfo;
21use g1t_contracts::actions::{BlobArgs, BlobGrant, BlobPart, BlobSignArgs, RuntimeAuthArgs, RuntimeJob};
22use g1t_contracts::time::rfc3339;
23use g1t_contracts::{FailureCode, Outcome};
24use g1t_kit::now_ms;
25use g1t_secrets::{hmac_sha256_hex, same, sha256_hex};
26use serde::Deserialize;
27use serde_json::{Value, json};
28use worker::Result;
29
30use crate::plan::{JobRow, RunRow};
31use crate::{Actions, check, fail};
32
33/// How long a blob token for an upload is good: as long as an unfinished
34/// upload is kept (cache.rs).
35pub(crate) const UPLOAD_SECONDS: u64 = 6 * 60 * 60;
36/// How long a blob token for a download is good: long enough to start one.
37pub(crate) const DOWNLOAD_SECONDS: u64 = 60 * 60;
38/// How long a download link the API redirects a person to is good.
39pub(crate) const LINK_SECONDS: u64 = 10 * 60;
40
41fn encode(bytes: &[u8]) -> String {
42 URL_SAFE_NO_PAD.encode(bytes)
43}
44
45fn decode_json(part: &str) -> Option<Value> {
46 serde_json::from_slice(&URL_SAFE_NO_PAD.decode(part).ok()?).ok()
47}
48
49/// HMAC-SHA256 of `body` under `key`, base64url.
50fn mac(key: &str, body: &str) -> String {
51 encode(&hex::decode(hmac_sha256_hex(key, body)).unwrap_or_default())
52}
53
54// ── The runtime token ───────────────────────────────────────────────────────
55
56/// The scopes the toolkit reads: `Actions.Results:{run}:{job}` names the
57/// run and job to `@actions/artifact`.
58pub(crate) fn scopes(run: &str, job: &str) -> String {
59 format!("Actions.GenericRead:00000000-0000-0000-0000-000000000000 Actions.UploadArtifacts:{run}:{job} Actions.Results:{run}:{job}")
60}
61
62/// A job's runtime token, good for `ttl` seconds from `now` (seconds).
63/// `token_hash` is the hash of the job's own token, as its row keeps it.
64pub(crate) fn runtime_token(job: &str, run: &str, token_hash: &str, now: u64, ttl: u64) -> String {
65 let header = encode(br#"{"typ":"JWT","alg":"HS256"}"#);
66 let claims = json!({
67 "iss": "g1t",
68 "sub": job,
69 "job": job,
70 "run": run,
71 "scp": scopes(run, job),
72 "iat": now,
73 "nbf": now.saturating_sub(60),
74 "exp": now + ttl,
75 });
76 let claims = encode(claims.to_string().as_bytes());
77 let signed = format!("{header}.{claims}");
78 let signature = mac(token_hash, &signed);
79 format!("{signed}.{signature}")
80}
81
82/// The job a runtime token says it is, unchecked: the API reads it to know
83/// which job to ask about.
84pub fn runtime_job(token: &str) -> Option<String> {
85 let claims = decode_json(token.split('.').nth(1)?)?;
86 claims["job"].as_str().map(str::to_owned)
87}
88
89/// Whether `token` is a good runtime token for `job`, whose own token
90/// hashes to `token_hash`, at `now` (seconds).
91pub(crate) fn runtime_valid(token: &str, job: &str, token_hash: &str, now: u64) -> bool {
92 let mut parts = token.split('.');
93 let (Some(header), Some(claims), Some(signature), None) = (parts.next(), parts.next(), parts.next(), parts.next()) else {
94 return false;
95 };
96 if !same(&mac(token_hash, &format!("{header}.{claims}")), signature) {
97 return false;
98 }
99 let Some(claims) = decode_json(claims) else { return false };
100 claims["job"].as_str() == Some(job) && claims["exp"].as_u64().is_some_and(|exp| exp > now)
101}
102
103/// Whether `token` looks like a runtime token rather than a job's own
104/// (which is hex).
105pub(crate) fn is_runtime(token: &str) -> bool {
106 token.matches('.').count() == 2
107}
108
109// ── Blob tokens ─────────────────────────────────────────────────────────────
110
111#[derive(Debug, PartialEq, serde::Serialize, Deserialize)]
112pub(crate) struct BlobClaims {
113 /// `cache` or `artifact`.
114 pub k: String,
115 /// The entry's id.
116 pub i: String,
117 /// Its object in R2.
118 pub o: String,
119 /// The R2 upload, for an upload.
120 #[serde(default)]
121 pub u: Option<String>,
122 /// Good until, seconds since the epoch.
123 pub e: u64,
124}
125
126/// The key blob tokens are signed with, from the service's own key.
127pub(crate) fn blob_key(actions_key: &str) -> String {
128 hmac_sha256_hex(actions_key, "g1t actions blob tokens v1")
129}
130
131pub(crate) fn sign_blob(key: &str, claims: &BlobClaims) -> String {
132 let payload = encode(serde_json::to_string(claims).unwrap_or_default().as_bytes());
133 let signature = mac(key, &payload);
134 format!("{payload}.{signature}")
135}
136
137/// What a blob token grants, if it is signed with `key` and good at `now`.
138pub(crate) fn open_blob(key: &str, token: &str, now: u64) -> Option<BlobClaims> {
139 let (payload, signature) = token.split_once('.')?;
140 if !same(&mac(key, payload), signature) {
141 return None;
142 }
143 let claims: BlobClaims = serde_json::from_value(decode_json(payload)?).ok()?;
144 (claims.e > now).then_some(claims)
145}
146
147// ── OIDC ────────────────────────────────────────────────────────────────────
148
149/// Whether a job may have an OIDC token: when its permissions, or its
150/// workflow's when it has none of its own, give `id-token: write`
151/// (`write-all` included). Nothing given gives no OIDC token, as GitHub's
152/// default token permissions do not include it.
153///
Merge branch 'worktree-agent-a3abfcce648e87dca'154/// Read with the same model as the job's token (`g1t_actions::permissions`).
Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2155pub(crate) fn id_token_permitted(workflow: &Value, job: &Value) -> bool {
Merge branch 'worktree-agent-a3abfcce648e87dca'156 use g1t_actions::permissions::{self, Access};
157 // A job's own `permissions:` replace the workflow's; without either,
158 // no default gives `id-token`, as on GitHub.
159 let written = |spec: &Value| spec.get("permissions").and_then(|value| permissions::parse(value).ok()).map(|(read, _)| read);
160 written(job).or_else(|| written(workflow)).is_some_and(|granted| granted.get("id-token") == Access::Write)
Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2161}
162
163/// A job's `environment:` name, when it names one plainly.
164pub(crate) fn environment_name(job: &Value) -> Option<String> {
165 match job.get("environment") {
166 Some(Value::String(name)) if !name.contains("${{") && !name.trim().is_empty() => Some(name.trim().to_owned()),
167 Some(Value::Object(env)) => env.get("name").and_then(Value::as_str).filter(|n| !n.contains("${{") && !n.trim().is_empty()).map(|n| n.trim().to_owned()),
168 _ => None,
169 }
170}
171
172/// GitHub's subject: by environment, else for a pull request, else by ref.
173pub fn subject(repository: &str, environment: Option<&str>, event: &str, git_ref: &str) -> String {
174 if let Some(environment) = environment {
175 return format!("repo:{repository}:environment:{environment}");
176 }
177 if event == "pull_request" || event == "pull_request_target" {
178 return format!("repo:{repository}:pull_request");
179 }
180 format!("repo:{repository}:ref:{git_ref}")
181}
182
183/// What an OIDC token says about a job, besides who issued it, for whom
184/// and when.
185pub(crate) struct ClaimFacts<'a> {
186 pub info: &'a RunInfo,
187 pub environment: Option<&'a str>,
188 /// The workflow that defines the job: a called workflow's own path.
189 pub job_workflow_path: &'a str,
190 pub private: bool,
191 pub owner_id: &'a str,
192 pub self_hosted: bool,
193}
194
195pub(crate) fn claims(facts: &ClaimFacts) -> Value {
196 let info = facts.info;
197 let owner = info.repository.split('/').next().unwrap_or_default();
198 let workflow_ref = format!("{}/{}@{}", info.repository, info.workflow_path, info.git_ref);
199 let job_workflow_ref = format!("{}/{}@{}", info.repository, facts.job_workflow_path, info.git_ref);
200 let mut claims = json!({
201 "sub": subject(&info.repository, facts.environment, &info.event_name, &info.git_ref),
202 "ref": info.git_ref,
203 "sha": info.sha,
204 "repository": info.repository,
205 "repository_owner": owner,
206 "repository_owner_id": facts.owner_id,
207 "repository_id": info.repository_id,
208 "repository_visibility": if facts.private { "private" } else { "public" },
209 "run_id": info.run_id,
210 "run_number": info.run_number.to_string(),
211 "run_attempt": info.run_attempt.to_string(),
212 "actor": info.actor,
213 "actor_id": info.actor_id,
214 "workflow": info.workflow,
215 "workflow_ref": workflow_ref,
216 "workflow_sha": info.sha,
217 "job_workflow_ref": job_workflow_ref,
218 "job_workflow_sha": info.sha,
219 "head_ref": info.head_ref.clone().unwrap_or_default(),
220 "base_ref": info.base_ref.clone().unwrap_or_default(),
221 "event_name": info.event_name,
222 "ref_type": info.ref_type(),
223 "ref_protected": (info.ref_name() == info.default_branch).to_string(),
224 "runner_environment": if facts.self_hosted { "self-hosted" } else { "github-hosted" },
225 });
226 if let Some(environment) = facts.environment {
227 claims["environment"] = json!(environment);
228 }
229 claims
230}
231
232impl Actions {
233 /// The running job a runtime token is for.
234 pub(crate) async fn job_for_runtime(&self, job: &str, token: &str) -> Result<Outcome<JobRow>> {
235 let row = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[job.into()])?.first::<JobRow>(None).await?;
236 Ok(match row {
237 Some(row)
238 if row.status == "in_progress"
239 && row.token_hash.as_deref().is_some_and(|hash| runtime_valid(token, job, hash, now_ms() / 1000)) =>
240 {
241 Outcome::Ok(row)
242 }
243 _ => fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."),
244 })
245 }
246
247 /// The running job a sandbox's credential is for: its job's own token,
248 /// or its runtime token. Only for the cache and artifacts: a runtime
249 /// token never reads a job's spec or reports for it.
250 pub(crate) async fn job_for_credential(&self, job: &str, token: &str) -> Result<Outcome<JobRow>> {
251 if is_runtime(token) {
252 return self.job_for_runtime(job, token).await;
253 }
254 let row = self.db.prepare("SELECT * FROM jobs WHERE id = ?").bind(&[job.into()])?.first::<JobRow>(None).await?;
255 Ok(match row {
256 Some(row) if row.status == "in_progress" && row.token_hash.as_deref().is_some_and(|hash| same(hash, &sha256_hex(token))) => Outcome::Ok(row),
257 _ => fail(FailureCode::Unauthenticated, "That job is not running, or the token is not its."),
258 })
259 }
260
261 /// `runtime_auth`.
262 pub async fn runtime_auth(&self, a: RuntimeAuthArgs) -> Result<Outcome<RuntimeJob>> {
263 let job = check!(self.job_for_runtime(&a.job, &a.token).await?);
264 let Some(run) = self.run_row(&job.run_id).await? else {
265 return Ok(fail(FailureCode::NotFound, "No such run."));
266 };
267 Ok(Outcome::Ok(RuntimeJob { job: job.id, run: job.run_id, repo_id: job.repo_id, namespace: job.namespace, repository: run.repo }))
268 }
269
270 /// `oidc_claims`.
271 pub async fn oidc_claims(&self, a: RuntimeAuthArgs) -> Result<Outcome<Value>> {
272 let job = check!(self.job_for_runtime(&a.job, &a.token).await?);
273 let Some(run) = self.run_row(&job.run_id).await? else {
274 return Ok(fail(FailureCode::NotFound, "No such run."));
275 };
276 let Some(permitted) = self.oidc_permitted(&run, &job) else {
277 return Ok(fail(FailureCode::Forbidden, "The workflow no longer reads."));
278 };
279 if !permitted.0 {
280 return Ok(fail(
281 FailureCode::Forbidden,
282 "This job has no OIDC token: give it `permissions: id-token: write` (a run of a pull request from outside the repository never has one).",
283 ));
284 }
285 let (repo, _) = match self.repo_by_id(&run.repo_id).await? {
286 Some(found) => found,
287 None => return Ok(fail(FailureCode::NotFound, "There is no such repository.")),
288 };
289 let info = run.info();
290 let facts = ClaimFacts {
291 info: &info,
292 environment: permitted.1.as_deref(),
293 job_workflow_path: &permitted.2,
294 private: repo.is_private,
295 owner_id: &repo.owner_id,
296 self_hosted: job.runner_id.is_some(),
297 };
298 Ok(Outcome::Ok(claims(&facts)))
299 }
300
301 /// Whether a job may have an OIDC token, its environment, and the path
302 /// of the workflow that defines it. A called workflow's job needs both
303 /// its own permissions and its caller's to allow it, as on GitHub. A
304 /// run that is not trusted (a pull request from outside) never may.
305 /// `None` when the workflow no longer reads.
306 fn oidc_permitted(&self, run: &RunRow, job: &JobRow) -> Option<(bool, Option<String>, String)> {
307 let caller = g1t_actions::workflow::parse(&run.source).ok()?;
308 let trusted = run.trusted != 0;
309 match job.callee() {
310 Some((called, spec, call)) => {
311 let parent = call["parent"].as_str().unwrap_or_default();
312 let caller_allows = caller.jobs.iter().find(|j| j.id == parent).is_none_or(|j| id_token_permitted(&caller.raw, &j.raw));
313 let path = call["path"].as_str().unwrap_or(&run.path).to_owned();
Merge branch 'worktree-agent-a3abfcce648e87dca'314 let environment = job.environment.clone().or_else(|| environment_name(&spec.raw));
315 Some((trusted && caller_allows && id_token_permitted(&called.raw, &spec.raw), environment, path))
Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2316 }
317 None => {
318 let spec = caller.jobs.iter().find(|j| j.id == job.key)?;
Merge branch 'worktree-agent-a3abfcce648e87dca'319 // As read when its needs were done, an expression's included.
320 let environment = job.environment.clone().or_else(|| environment_name(&spec.raw));
321 Some((trusted && id_token_permitted(&caller.raw, &spec.raw), environment, run.path.clone()))
Actions: OIDC tokens, the toolkit's cache and artifact services, and artifacts in R2322 }
323 }
324 }
325
326 /// Whether a job may have an OIDC token, for its spec.
327 pub(crate) fn oidc_allowed(&self, run: &RunRow, job: &JobRow) -> bool {
328 self.oidc_permitted(run, job).is_some_and(|p| p.0)
329 }
330
331 fn blob_signing_key(&self) -> Option<String> {
332 self.blob_key.clone()
333 }
334
335 /// `blob_sign`.
336 pub async fn blob_sign(&self, a: BlobSignArgs) -> Result<Outcome<String>> {
337 let job = check!(self.job_for_credential(&a.job, &a.token).await?);
338 let Some(key) = self.blob_signing_key() else {
339 return Ok(fail(FailureCode::Invalid, "The toolkit's storage is not set up here: the actions service has no ACTIONS_KEY."));
340 };
341 let object = match a.kind.as_str() {
342 "cache" => {
343 #[derive(Deserialize)]
344 struct Row {
345 object: String,
346 }
347 let row = self
348 .db
349 .prepare("UPDATE cache_entries SET upload = ? WHERE id = ? AND repo_id = ? AND status = 'pending' RETURNING object")
350 .bind(&[a.upload.as_str().into(), a.id.as_str().into(), job.repo_id.as_str().into()])?
351 .first::<Row>(None)
352 .await?;
353 row.map(|r| r.object)
354 }
355 "artifact" => {
356 #[derive(Deserialize)]
357 struct Row {
358 object: String,
359 }
360 let id: f64 = a.id.parse().unwrap_or(-1.0);
361 self.db
362 .prepare("SELECT object FROM artifacts WHERE id = ? AND run_id = ? AND status = 'pending'")
363 .bind(&[id.into(), job.run_id.as_str().into()])?
364 .first::<Row>(None)
365 .await?
366 .map(|r| r.object)
367 }
368 _ => None,
369 };
370 let Some(object) = object else {
371 return Ok(fail(FailureCode::NotFound, "No upload of that is in progress."));
372 };
373 let claims = BlobClaims { k: a.kind, i: a.id, o: object, u: Some(a.upload), e: now_ms() / 1000 + UPLOAD_SECONDS };
374 Ok(Outcome::Ok(sign_blob(&key, &claims)))
375 }
376
377 /// An upload token for an entry whose R2 upload has been started.
378 pub(crate) fn upload_token(&self, kind: &str, id: &str, object: &str, upload: &str) -> Option<String> {
379 let key = self.blob_signing_key()?;
380 let claims = BlobClaims { k: kind.to_owned(), i: id.to_owned(), o: object.to_owned(), u: Some(upload.to_owned()), e: now_ms() / 1000 + UPLOAD_SECONDS };
381 Some(sign_blob(&key, &claims))
382 }
383
384 /// A download token for an entry, good for `seconds`.
385 pub(crate) fn download_token(&self, kind: &str, id: &str, object: &str, seconds: u64) -> Option<String> {
386 let key = self.blob_signing_key()?;
387 Some(sign_blob(&key, &BlobClaims { k: kind.to_owned(), i: id.to_owned(), o: object.to_owned(), u: None, e: now_ms() / 1000 + seconds }))
388 }
389
390 fn opened(&self, token: &str) -> Option<BlobClaims> {
391 open_blob(&self.blob_signing_key()?, token, now_ms() / 1000)
392 }
393
394 /// `blob_open`.
395 pub async fn blob_open(&self, a: BlobArgs) -> Result<Outcome<BlobGrant>> {
396 let Some(claims) = self.opened(&a.blob) else {
397 return Ok(fail(FailureCode::Unauthenticated, "That link has expired or is not one of g1t's."));
398 };
399 // A download needs its entry still there; an upload, still pending.
400 let wanted = if claims.u.is_some() { "pending" } else { "ready" };
401 let (exists, filename, content_type) = match claims.k.as_str() {
402 "cache" => {
403 let row = self
404 .db
405 .prepare("SELECT id FROM cache_entries WHERE id = ? AND object = ? AND status = ?")
406 .bind(&[claims.i.as_str().into(), claims.o.as_str().into(), wanted.into()])?
407 .first::<Value>(None)
408 .await?;
409 (row.is_some(), None, Some("application/octet-stream".to_owned()))
410 }
411 _ => {
412 #[derive(Deserialize)]
413 struct Row {
414 name: String,
415 format: String,
416 }
417 let id: f64 = claims.i.parse().unwrap_or(-1.0);
418 let row = self
419 .db
420 .prepare("SELECT name, format FROM artifacts WHERE id = ? AND object = ? AND status = ?")
421 .bind(&[id.into(), claims.o.as_str().into(), wanted.into()])?
422 .first::<Row>(None)
423 .await?;
424 match row {
425 Some(row) => {
426 let (extension, kind) = if row.format == "tgz" { ("tar.gz", "application/gzip") } else { ("zip", "application/zip") };
427 (true, Some(format!("{}.{extension}", row.name)), Some(kind.to_owned()))
428 }
429 None => (false, None, None),
430 }
431 }
432 };
433 if !exists {
434 return Ok(fail(FailureCode::NotFound, "That is gone: it expired, was deleted, or its upload finished."));
435 }
436 Ok(Outcome::Ok(BlobGrant { kind: claims.k, id: claims.i, object: claims.o, upload: claims.u, filename, content_type }))
437 }
438
439 /// `blob_part`.
440 pub async fn blob_part(&self, a: BlobArgs) -> Result<Outcome<bool>> {
441 let Some(BlobClaims { u: Some(upload), .. }) = self.opened(&a.blob) else {
442 return Ok(fail(FailureCode::Unauthenticated, "That link has expired or is not an upload."));
443 };
444 self.db
445 .prepare(
446 "INSERT INTO blob_parts (upload, part, etag, size, created_at) VALUES (?1, ?2, ?3, ?4, ?5)
447 ON CONFLICT (upload, part) DO UPDATE SET etag = ?3, size = ?4, created_at = ?5",
448 )
449 .bind(&[upload.as_str().into(), f64::from(a.part).into(), a.etag.as_str().into(), (a.size as f64).into(), rfc3339(now_ms()).into()])?
450 .run()
451 .await?;
452 Ok(Outcome::Ok(true))
453 }
454
455 /// `blob_parts`.
456 pub async fn blob_parts(&self, a: BlobArgs) -> Result<Outcome<Vec<BlobPart>>> {
457 let Some(BlobClaims { u: Some(upload), .. }) = self.opened(&a.blob) else {
458 return Ok(fail(FailureCode::Unauthenticated, "That link has expired or is not an upload."));
459 };
460 #[derive(Deserialize)]
461 struct Row {
462 part: f64,
463 etag: String,
464 size: f64,
465 }
466 let rows = self
467 .db
468 .prepare("SELECT part, etag, size FROM blob_parts WHERE upload = ? ORDER BY part")
469 .bind(&[upload.as_str().into()])?
470 .all()
471 .await?
472 .results::<Row>()?;
473 Ok(Outcome::Ok(rows.into_iter().map(|r| BlobPart { part: r.part as u32, etag: r.etag, size: r.size as u64 }).collect()))
474 }
475
476 /// `blob_done`: the upload is complete at `size` bytes, as R2 measured
477 /// it, which is the size its entry is committed at.
478 pub async fn blob_done(&self, a: BlobArgs) -> Result<Outcome<bool>> {
479 let Some(BlobClaims { k, i, u: Some(upload), .. }) = self.opened(&a.blob) else {
480 return Ok(Outcome::Ok(false));
481 };
482 self.db.prepare("DELETE FROM blob_parts WHERE upload = ?").bind(&[upload.as_str().into()])?.run().await?;
483 let size = (a.size as f64).into();
484 if k == "cache" {
485 self.db
486 .prepare("UPDATE cache_entries SET size = ? WHERE id = ? AND status = 'pending'")
487 .bind(&[size, i.as_str().into()])?
488 .run()
489 .await?;
490 } else {
491 self.db
492 .prepare("UPDATE artifacts SET size = ? WHERE id = ? AND status = 'pending'")
493 .bind(&[size, i.parse::<f64>().unwrap_or(-1.0).into()])?
494 .run()
495 .await?;
496 }
497 Ok(Outcome::Ok(true))
498 }
499
500 /// Hourly: parts of uploads abandoned long ago.
501 pub(crate) async fn sweep_blob_parts(&self, now: u64) -> Result<()> {
502 self.db
503 .prepare("DELETE FROM blob_parts WHERE created_at < ?")
504 .bind(&[rfc3339(now.saturating_sub(UPLOAD_SECONDS * 1000 * 2)).into()])?
505 .run()
506 .await?;
507 Ok(())
508 }
509}
510
511#[cfg(test)]
512mod tests {
513 use super::*;
514
515 const HASH: &str = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08";
516
517 #[test]
518 fn a_runtime_token_is_a_jwt_the_toolkit_reads() {
519 let token = runtime_token("job_1", "run_1", HASH, 1_700_000_000, 3600);
520 let parts: Vec<&str> = token.split('.').collect();
521 assert_eq!(parts.len(), 3);
522 let header = decode_json(parts[0]).unwrap();
523 assert_eq!(header["alg"], "HS256");
524 let claims = decode_json(parts[1]).unwrap();
525 // @actions/artifact finds the run and job in the `Actions.Results`
526 // scope: three parts split on `:`.
527 let results = claims["scp"].as_str().unwrap().split(' ').find(|s| s.starts_with("Actions.Results:")).unwrap();
528 assert_eq!(results.split(':').collect::<Vec<_>>(), ["Actions.Results", "run_1", "job_1"]);
529 assert_eq!(runtime_job(&token).as_deref(), Some("job_1"));
530 assert!(is_runtime(&token) && !is_runtime(HASH));
531 }
532
533 #[test]
534 fn a_runtime_token_is_checked_against_its_job() {
535 let token = runtime_token("job_1", "run_1", HASH, 1_700_000_000, 3600);
536 assert!(runtime_valid(&token, "job_1", HASH, 1_700_000_100));
537 // Another job, another job's key, too late.
538 assert!(!runtime_valid(&token, "job_2", HASH, 1_700_000_100));
539 assert!(!runtime_valid(&token, "job_1", &"0".repeat(64), 1_700_000_100));
540 assert!(!runtime_valid(&token, "job_1", HASH, 1_700_003_601));
541 // Claims changed without the key.
542 let parts: Vec<&str> = token.split('.').collect();
543 let forged = encode(json!({ "job": "job_1", "run": "run_9", "exp": 9_999_999_999u64 }).to_string().as_bytes());
544 assert!(!runtime_valid(&format!("{}.{forged}.{}", parts[0], parts[2]), "job_1", HASH, 1_700_000_100));
545 assert!(!runtime_valid("a.b", "job_1", HASH, 0));
546 }
547
548 #[test]
549 fn blob_tokens_are_signed_and_expire() {
550 let key = blob_key("00".repeat(32).as_str());
551 let claims = BlobClaims { k: "artifact".into(), i: "12".into(), o: "a/repo_1/12".into(), u: Some("up".into()), e: 1_000 };
552 let token = sign_blob(&key, &claims);
553 assert_eq!(open_blob(&key, &token, 999), Some(claims));
554 assert_eq!(open_blob(&key, &token, 1_000), None);
555 assert_eq!(open_blob(&blob_key("11".repeat(32).as_str()), &token, 999), None);
556 let (payload, _) = token.split_once('.').unwrap();
557 assert_eq!(open_blob(&key, &format!("{payload}.AAAA"), 999), None);
558 }
559
560 #[test]
561 fn id_token_needs_write_in_the_job_or_else_the_workflow() {
562 let wf = |p: Value| json!({ "permissions": p });
563 let none = json!({});
564 assert!(!id_token_permitted(&none, &none));
565 assert!(id_token_permitted(&wf(json!({ "id-token": "write", "contents": "read" })), &none));
566 assert!(!id_token_permitted(&wf(json!({ "id-token": "read" })), &none));
567 assert!(id_token_permitted(&wf(json!("write-all")), &none));
568 assert!(!id_token_permitted(&wf(json!("read-all")), &none));
569 // The job's own permissions replace the workflow's entirely.
570 assert!(!id_token_permitted(&wf(json!({ "id-token": "write" })), &json!({ "permissions": { "contents": "read" } })));
571 assert!(id_token_permitted(&wf(json!({})), &json!({ "permissions": { "id-token": "write" } })));
572 assert!(!id_token_permitted(&none, &json!({ "permissions": {} })));
573 }
574
575 #[test]
576 fn subjects_are_github_s() {
577 assert_eq!(subject("acme/web", None, "push", "refs/heads/main"), "repo:acme/web:ref:refs/heads/main");
578 assert_eq!(subject("acme/web", None, "push", "refs/tags/v1"), "repo:acme/web:ref:refs/tags/v1");
579 assert_eq!(subject("acme/web", Some("prod"), "push", "refs/heads/main"), "repo:acme/web:environment:prod");
580 assert_eq!(subject("acme/web", None, "pull_request", "refs/pull/3/merge"), "repo:acme/web:pull_request");
581 assert_eq!(subject("acme/web", None, "pull_request_target", "refs/heads/main"), "repo:acme/web:pull_request");
582 // An environment wins over a pull request, as on GitHub.
583 assert_eq!(subject("acme/web", Some("preview"), "pull_request", "refs/pull/3/merge"), "repo:acme/web:environment:preview");
584 }
585
586 #[test]
587 fn environments_are_named_plainly_or_not_at_all() {
588 assert_eq!(environment_name(&json!({ "environment": "production" })).as_deref(), Some("production"));
589 assert_eq!(environment_name(&json!({ "environment": { "name": "staging", "url": "x" } })).as_deref(), Some("staging"));
590 assert_eq!(environment_name(&json!({ "environment": "${{ inputs.env }}" })), None);
591 assert_eq!(environment_name(&json!({})), None);
592 }
593
594 #[test]
595 fn claims_carry_what_trust_policies_read() {
596 let info = RunInfo {
597 repository: "acme/web".into(),
598 repository_id: "repo_1".into(),
599 default_branch: "main".into(),
600 event_name: "push".into(),
601 git_ref: "refs/heads/main".into(),
602 sha: "abc".into(),
603 actor: "ada".into(),
604 actor_id: "usr_1".into(),
605 run_id: "run_1".into(),
606 run_number: 7,
607 run_attempt: 2,
608 workflow: "Deploy".into(),
609 workflow_path: ".g1t/workflows/deploy.yml".into(),
610 ..RunInfo::default()
611 };
612 let facts = ClaimFacts {
613 info: &info,
614 environment: Some("production"),
615 job_workflow_path: ".g1t/workflows/release.yml",
616 private: true,
617 owner_id: "ws_1",
618 self_hosted: false,
619 };
620 let c = claims(&facts);
621 assert_eq!(c["sub"], "repo:acme/web:environment:production");
622 assert_eq!(c["environment"], "production");
623 assert_eq!(c["repository_owner"], "acme");
624 assert_eq!(c["repository_owner_id"], "ws_1");
625 assert_eq!(c["repository_visibility"], "private");
626 assert_eq!(c["run_number"], "7");
627 assert_eq!(c["run_attempt"], "2");
628 assert_eq!(c["workflow_ref"], "acme/web/.g1t/workflows/deploy.yml@refs/heads/main");
629 assert_eq!(c["job_workflow_ref"], "acme/web/.g1t/workflows/release.yml@refs/heads/main");
630 assert_eq!(c["ref_type"], "branch");
631 assert_eq!(c["ref_protected"], "true");
632 assert_eq!(c["runner_environment"], "github-hosted");
633 for absent in ["iss", "aud", "exp", "iat", "jti"] {
634 assert!(c.get(absent).is_none(), "{absent} is the API's to add");
635 }
636 }
637}

This file's history is long; its oldest lines are credited to the oldest commit read.