| 1 | //! Access tokens: the `g1t_…` secrets used by git, the API and the MCP |
| 2 | //! server. |
| 3 | //! |
| 4 | //! There is one kind of token and two kinds of owner. A personal token |
| 5 | //! acts as the person who made it. A workspace's token belongs to the |
| 6 | //! workspace and acts as it, so automation needs no account of its own and |
| 7 | //! keeps working when the member who set it up leaves. Either is made and |
| 8 | //! changed with permissions and a reach (token_reach.rs); this file mints, |
| 9 | //! resolves, lists and deletes them. |
| 10 | |
| 11 | use g1t_contracts::identity::*; |
| 12 | use g1t_contracts::scopes::{FULL_ACCESS, JobToken, Scope, TokenAccess, everything, parse_scopes, permissions_of, scopes_text}; |
| 13 | use g1t_contracts::time::{SQL_NOW, rfc3339}; |
| 14 | use g1t_contracts::{FailureCode, Membership, Outcome, PrincipalKind, Role, User, Viewer, new_id}; |
| 15 | use g1t_kit::now_ms; |
| 16 | use serde::Deserialize; |
| 17 | use worker::Result; |
| 18 | use worker::wasm_bindgen::JsValue; |
| 19 | |
| 20 | use crate::{Identity, crypto}; |
| 21 | |
| 22 | pub const TOKEN_PREFIX: &str = "g1t_"; |
| 23 | /// How stale a token's last-used time may get before it is written again. |
| 24 | const LAST_USED_RESOLUTION_MS: u64 = 5 * 60 * 1000; |
| 25 | pub(crate) const MAX_TOKENS_PER_WORKSPACE: usize = 50; |
| 26 | const WORKSPACE_ID_PREFIX: &str = "wsp_"; |
| 27 | |
| 28 | pub(crate) const TOKEN_COLUMNS: &str = "access_tokens.id, access_tokens.name, access_tokens.created_at, |
| 29 | access_tokens.last_used_at, users.username AS created_by, access_tokens.scopes, |
| 30 | access_tokens.expires_at, access_tokens.description, access_tokens.admin, |
| 31 | access_tokens.workspace_id, access_tokens.repository_selection, |
| 32 | access_tokens.status, access_tokens.review_reason, access_tokens.website, |
| 33 | (SELECT slug FROM workspaces WHERE workspaces.id = access_tokens.owner_workspace_id) AS owner_workspace"; |
| 34 | |
| 35 | /// Who a new token belongs to. |
| 36 | pub(crate) enum Owner<'a> { |
| 37 | User(&'a str), |
| 38 | Workspace { |
| 39 | id: &'a str, |
| 40 | created_by: Option<&'a str>, |
| 41 | }, |
| 42 | } |
| 43 | |
| 44 | #[derive(Deserialize)] |
| 45 | pub(crate) struct TokenRow { |
| 46 | id: String, |
| 47 | name: String, |
| 48 | created_at: String, |
| 49 | last_used_at: Option<String>, |
| 50 | created_by: Option<String>, |
| 51 | scopes: Option<String>, |
| 52 | expires_at: Option<String>, |
| 53 | /// Its reach, status, description and a workspace token's Admin |
| 54 | /// (migration 0034; see token_reach.rs). |
| 55 | #[serde(flatten)] |
| 56 | pub(crate) more: crate::token_reach::TokenRowMore, |
| 57 | } |
| 58 | |
| 59 | /// What a token or grant may do, as it is to be stored. A token reaches |
| 60 | /// whatever its owner can; only its scopes narrow that. |
| 61 | /// |
| 62 | /// The `resources` columns (migration 0022) held a limit to some |
| 63 | /// workspaces or repositories. That limit was retired (migration 0023); |
| 64 | /// the columns stay, since D1 cannot drop them in place, and nothing |
| 65 | /// reads or writes them. |
| 66 | #[derive(Clone, Debug, Default)] |
| 67 | pub(crate) struct Grant { |
| 68 | /// Null: full access. |
| 69 | pub scopes: Option<Vec<Scope>>, |
| 70 | } |
| 71 | |
| 72 | impl Grant { |
| 73 | /// From what a caller asked for: unknown scopes are left out. |
| 74 | pub(crate) fn asked(scopes: &Option<Vec<String>>) -> Self { |
| 75 | Grant { |
| 76 | scopes: scopes.as_ref().map(|scopes| parse_scopes(&scopes.join(" "))), |
| 77 | } |
| 78 | } |
| 79 | |
| 80 | /// The `scopes` column: `*` for full access. |
| 81 | pub(crate) fn scopes_column(&self) -> String { |
| 82 | match &self.scopes { |
| 83 | None => FULL_ACCESS.to_owned(), |
| 84 | Some(scopes) => scopes_text(scopes), |
| 85 | } |
| 86 | } |
| 87 | } |
| 88 | |
| 89 | /// A `scopes` column read back: the scopes (null for full access), and |
| 90 | /// whether it is a legacy row, made before scopes. |
| 91 | pub(crate) fn stored_scopes(column: Option<&str>) -> (Option<Vec<String>>, bool) { |
| 92 | match column { |
| 93 | None => (None, true), |
| 94 | Some(FULL_ACCESS) => (None, false), |
| 95 | Some(text) => ( |
| 96 | Some(parse_scopes(text).iter().map(|scope| scope.as_str().to_owned()).collect()), |
| 97 | false, |
| 98 | ), |
| 99 | } |
| 100 | } |
| 101 | |
| 102 | /// The owner of a token being used. |
| 103 | #[derive(Deserialize)] |
| 104 | struct Presented { |
| 105 | id: String, |
| 106 | user_id: Option<String>, |
| 107 | workspace_id: Option<String>, |
| 108 | last_used_at: Option<String>, |
| 109 | /// Set on an agent's token: what it may do, as JSON `AgentScope`. |
| 110 | agent_scope: Option<String>, |
| 111 | scopes: Option<String>, |
| 112 | #[serde(default)] |
| 113 | name: Option<String>, |
| 114 | /// Set on a workflow job's token (job_tokens.rs): its repository, job |
| 115 | /// and run. |
| 116 | #[serde(default)] |
| 117 | repo: Option<String>, |
| 118 | #[serde(default)] |
| 119 | job_id: Option<String>, |
| 120 | #[serde(default)] |
| 121 | job_run_id: Option<String>, |
| 122 | #[serde(default)] |
| 123 | job_pulls: Option<u32>, |
| 124 | /// 1 when its owner let it use the website (migration 0043). |
| 125 | #[serde(default)] |
| 126 | website: Option<f64>, |
| 127 | /// The workspace it is made for, its repositories and status, a |
| 128 | /// workspace token's Admin, and when it was made and expires, for the |
| 129 | /// rules of the workspaces it reaches (token_reach.rs). |
| 130 | #[serde(flatten)] |
| 131 | facts: crate::token_reach::Facts, |
| 132 | } |
| 133 | |
| 134 | #[derive(Deserialize)] |
| 135 | struct WorkspaceRef { |
| 136 | id: String, |
| 137 | slug: String, |
| 138 | } |
| 139 | |
| 140 | fn text(value: Option<&str>) -> JsValue { |
| 141 | value.map_or(JsValue::NULL, JsValue::from) |
| 142 | } |
| 143 | |
| 144 | /// Whether a token being used may be used on the website as its owner: one |
| 145 | /// a person made and turned that on for, never a workspace's, a job's or an |
| 146 | /// agent's (apps/web, app/lib/website-token.ts). |
| 147 | fn website_allowed(presented: &Presented) -> bool { |
| 148 | presented.website.is_some_and(|on| on >= 1.0) |
| 149 | && presented.user_id.is_some() |
| 150 | && presented.workspace_id.is_none() |
| 151 | && presented.job_id.is_none() |
| 152 | && presented.agent_scope.is_none() |
| 153 | } |
| 154 | |
| 155 | impl Identity { |
| 156 | pub async fn user_for_access_token(&self, token: &str) -> Result<Viewer> { |
| 157 | if !token.starts_with(TOKEN_PREFIX) { |
| 158 | return Ok(None); |
| 159 | } |
| 160 | let Some(presented) = self |
| 161 | .db |
| 162 | .prepare(format!( |
| 163 | "SELECT id, user_id, workspace_id, last_used_at, agent_scope, scopes, name, |
| 164 | repo, job_id, job_run_id, job_pulls, created_at, expires_at, |
| 165 | owner_workspace_id, repository_selection, status, admin, website |
| 166 | FROM access_tokens |
| 167 | WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > {SQL_NOW})" |
| 168 | )) |
| 169 | .bind(&[crypto::sha256_hex(token).into()])? |
| 170 | .first::<Presented>(None) |
| 171 | .await? |
| 172 | else { |
| 173 | return Ok(None); |
| 174 | }; |
| 175 | // An agent's token: g1t on behalf of the person it was made |
| 176 | // for, in its repository's workspace while they belong to it, and |
| 177 | // only for what its scope lists. See run_credentials.rs. |
| 178 | if let Some(scope) = presented |
| 179 | .agent_scope |
| 180 | .as_deref() |
| 181 | .and_then(|scope| serde_json::from_str::<AgentScope>(scope).ok()) |
| 182 | { |
| 183 | return self |
| 184 | .agent_principal( |
| 185 | &presented.id, |
| 186 | presented.user_id.as_deref(), |
| 187 | presented.workspace_id.as_deref(), |
| 188 | scope, |
| 189 | ) |
| 190 | .await; |
| 191 | } |
| 192 | let mut viewer = match (&presented.user_id, &presented.workspace_id) { |
| 193 | (Some(user_id), _) => { |
| 194 | self.find_user( |
| 195 | "SELECT id, username, display_username, email_verified_at IS NOT NULL AS verified, avatar |
| 196 | FROM users WHERE id = ? AND deleted_at IS NULL", |
| 197 | user_id, |
| 198 | ) |
| 199 | .await? |
| 200 | } |
| 201 | (None, Some(workspace_id)) => self.workspace_principal(workspace_id).await?, |
| 202 | (None, None) => None, |
| 203 | }; |
| 204 | if let Some(user) = viewer.as_mut() { |
| 205 | self.note_use(&presented).await?; |
| 206 | let (scopes, legacy) = stored_scopes(presented.scopes.as_deref()); |
| 207 | user.token = Some(Box::new(TokenAccess { |
| 208 | token_id: presented.id.clone(), |
| 209 | scopes, |
| 210 | legacy, |
| 211 | name: presented.name.clone(), |
| 212 | repo: presented.repo.clone(), |
| 213 | job: match (&presented.job_id, &presented.job_run_id) { |
| 214 | (Some(job_id), Some(run_id)) => Some(JobToken { |
| 215 | run_id: run_id.clone(), |
| 216 | job_id: job_id.clone(), |
| 217 | pull_requests: presented.job_pulls == Some(1), |
| 218 | }), |
| 219 | _ => None, |
| 220 | }, |
| 221 | website: website_allowed(&presented), |
| 222 | ..TokenAccess::default() |
| 223 | })); |
| 224 | // What it reaches: the workspace it is made for and its |
| 225 | // repositories, the workspaces whose rules let it in, a |
| 226 | // workspace token's role. |
| 227 | self.apply_reach(user, &presented.id, presented.user_id.is_some(), &presented.facts).await?; |
| 228 | } |
| 229 | Ok(viewer) |
| 230 | } |
| 231 | |
| 232 | pub(crate) fn info(row: TokenRow) -> AccessToken { |
| 233 | let (scopes, legacy) = stored_scopes(row.scopes.as_deref()); |
| 234 | let held: Vec<Scope> = scopes.as_ref().map_or_else(everything, |scopes| scopes.iter().filter_map(|scope| Scope::parse(scope)).collect()); |
| 235 | let mut info = AccessToken { |
| 236 | id: row.id, |
| 237 | name: row.name, |
| 238 | created_at: row.created_at, |
| 239 | last_used_at: row.last_used_at, |
| 240 | created_by: row.created_by, |
| 241 | scopes, |
| 242 | legacy, |
| 243 | expires_at: row.expires_at, |
| 244 | permissions: permissions_of(&held), |
| 245 | ..AccessToken::default() |
| 246 | }; |
| 247 | row.more.describe(&mut info); |
| 248 | info |
| 249 | } |
| 250 | |
| 251 | /// A workspace as the actor behind one of its own tokens. It can do |
| 252 | /// what a member can, in that workspace only. |
| 253 | pub(crate) async fn workspace_principal(&self, workspace_id: &str) -> Result<Viewer> { |
| 254 | let workspace = self |
| 255 | .db |
| 256 | // A deleted workspace's tokens are refused until it is restored, |
| 257 | // and a suspended one's until staff lift it (suspension.rs). |
| 258 | .prepare("SELECT id, slug FROM workspaces WHERE id = ? AND deleted_at IS NULL AND suspended_at IS NULL") |
| 259 | .bind(&[workspace_id.into()])? |
| 260 | .first::<WorkspaceRef>(None) |
| 261 | .await?; |
| 262 | Ok(workspace.map(|workspace| User { |
| 263 | id: workspace.id, |
| 264 | username: workspace.slug.clone(), |
| 265 | kind: PrincipalKind::Workspace, |
| 266 | verified: true, |
| 267 | workspaces: vec![Membership::member(workspace.slug)], |
| 268 | ..User::default() |
| 269 | })) |
| 270 | } |
| 271 | |
| 272 | async fn note_use(&self, presented: &Presented) -> Result<()> { |
| 273 | let now = now_ms(); |
| 274 | let stale = rfc3339(now.saturating_sub(LAST_USED_RESOLUTION_MS)); |
| 275 | if presented |
| 276 | .last_used_at |
| 277 | .as_deref() |
| 278 | .is_some_and(|at| at >= stale.as_str()) |
| 279 | { |
| 280 | return Ok(()); |
| 281 | } |
| 282 | self.db |
| 283 | .prepare("UPDATE access_tokens SET last_used_at = ? WHERE id = ?") |
| 284 | .bind(&[rfc3339(now).into(), presented.id.as_str().into()])? |
| 285 | .run() |
| 286 | .await?; |
| 287 | Ok(()) |
| 288 | } |
| 289 | |
| 290 | pub(crate) async fn mint( |
| 291 | &self, |
| 292 | owner: Owner<'_>, |
| 293 | name: &str, |
| 294 | ttl_seconds: Option<u64>, |
| 295 | grant: &Grant, |
| 296 | listed: bool, |
| 297 | ) -> Result<CreatedAccessToken> { |
| 298 | let token = format!("{TOKEN_PREFIX}{}", crypto::random_hex(20)); |
| 299 | let now = now_ms(); |
| 300 | let name: String = match name.trim() { |
| 301 | "" => "Access token".to_owned(), |
| 302 | name => name.chars().take(100).collect(), |
| 303 | }; |
| 304 | let (user_id, workspace_id, created_by) = match owner { |
| 305 | Owner::User(id) => (Some(id), None, Some(id)), |
| 306 | Owner::Workspace { id, created_by } => (None, Some(id), created_by), |
| 307 | }; |
| 308 | let expires_at = ttl_seconds.map(|ttl| rfc3339(now + ttl * 1000)); |
| 309 | let info = AccessToken { |
| 310 | id: new_id("tok", now), |
| 311 | name, |
| 312 | created_at: rfc3339(now), |
| 313 | last_used_at: None, |
| 314 | created_by: None, |
| 315 | scopes: grant |
| 316 | .scopes |
| 317 | .as_ref() |
| 318 | .map(|scopes| scopes.iter().map(|scope| scope.as_str().to_owned()).collect()), |
| 319 | legacy: false, |
| 320 | expires_at: expires_at.clone(), |
| 321 | permissions: permissions_of(&grant.scopes.clone().unwrap_or_else(everything)), |
| 322 | workspace_owned: workspace_id.is_some(), |
| 323 | ..AccessToken::default() |
| 324 | }; |
| 325 | self.db |
| 326 | .prepare( |
| 327 | "INSERT INTO access_tokens |
| 328 | (id, user_id, workspace_id, created_by, name, token_hash, created_at, expires_at, |
| 329 | scopes, listed) |
| 330 | VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", |
| 331 | ) |
| 332 | .bind(&[ |
| 333 | info.id.as_str().into(), |
| 334 | text(user_id), |
| 335 | text(workspace_id), |
| 336 | text(created_by), |
| 337 | info.name.as_str().into(), |
| 338 | crypto::sha256_hex(&token).into(), |
| 339 | info.created_at.as_str().into(), |
| 340 | text(expires_at.as_deref()), |
| 341 | grant.scopes_column().into(), |
| 342 | JsValue::from(u8::from(listed)), |
| 343 | ])? |
| 344 | .run() |
| 345 | .await?; |
| 346 | Ok(CreatedAccessToken { token, info }) |
| 347 | } |
| 348 | |
| 349 | /// A workspace's own token that expires and is never listed: what a |
| 350 | /// workflow job's token is minted as (job_tokens.rs). |
| 351 | pub(crate) async fn mint_for_workspace( |
| 352 | &self, |
| 353 | workspace_id: &str, |
| 354 | name: &str, |
| 355 | ttl_seconds: u64, |
| 356 | grant: &Grant, |
| 357 | ) -> Result<CreatedAccessToken> { |
| 358 | self.mint( |
| 359 | Owner::Workspace { |
| 360 | id: workspace_id, |
| 361 | created_by: None, |
| 362 | }, |
| 363 | name, |
| 364 | Some(ttl_seconds), |
| 365 | grant, |
| 366 | false, |
| 367 | ) |
| 368 | .await |
| 369 | } |
| 370 | |
| 371 | pub async fn create_access_token( |
| 372 | &self, |
| 373 | a: CreateAccessTokenArgs, |
| 374 | ) -> Result<CreatedAccessToken> { |
| 375 | // Told apart by the id, which says what it names, since callers pass |
| 376 | // on actors that other services stored as an id and a name. |
| 377 | let owner = if a.user.id.starts_with(WORKSPACE_ID_PREFIX) { |
| 378 | Owner::Workspace { |
| 379 | id: &a.user.id, |
| 380 | created_by: None, |
| 381 | } |
| 382 | } else { |
| 383 | Owner::User(&a.user.id) |
| 384 | }; |
| 385 | let created = self.mint(owner, &a.name, a.ttl_seconds, &Grant::asked(&a.scopes), a.listed).await?; |
| 386 | // A person's lasting token: in their security log and their |
| 387 | // workspaces' audit logs. Short-lived ones (agents' runs, OAuth |
| 388 | // access tokens) are recorded where they are made. |
| 389 | if a.ttl_seconds.is_none() && !a.user.id.starts_with(WORKSPACE_ID_PREFIX) && !a.user.username.is_empty() { |
| 390 | self.log_security(&a.user.id, "token_created", Some(&created.info.name), None).await; |
| 391 | self.audit_account(&a.user, "token.created", &format!("Created access token {}", created.info.name)).await; |
| 392 | } |
| 393 | Ok(created) |
| 394 | } |
| 395 | |
| 396 | /// `remove_access_token`: deletes one of a person's own tokens. |
| 397 | pub async fn remove_access_token(&self, a: RemoveArgs) -> Result<()> { |
| 398 | let name: Option<String> = self |
| 399 | .db |
| 400 | .prepare("DELETE FROM access_tokens WHERE id = ? AND user_id = ? RETURNING name") |
| 401 | .bind(&[a.id.as_str().into(), a.user.id.as_str().into()])? |
| 402 | .first(Some("name")) |
| 403 | .await?; |
| 404 | if let Some(name) = name { |
| 405 | self.log_security(&a.user.id, "token_deleted", Some(&name), None).await; |
| 406 | self.audit_account(&a.user, "token.deleted", &format!("Deleted access token {name}")).await; |
| 407 | } |
| 408 | Ok(()) |
| 409 | } |
| 410 | |
| 411 | /// A token for a g1t agent working for `on_behalf_of`, which can do |
| 412 | /// only what `scope` lists. It is recorded as theirs, so it is listed and |
| 413 | /// can be deleted with their other tokens. |
| 414 | pub async fn create_agent_token(&self, a: CreateAgentTokenArgs) -> Result<CreatedAccessToken> { |
| 415 | let created = self |
| 416 | .mint( |
| 417 | Owner::User(&a.on_behalf_of.id), |
| 418 | &format!("g1t agent in {}/{}", a.scope.repo.namespace, a.scope.repo.name), |
| 419 | Some(a.ttl_seconds), |
| 420 | &Grant::default(), |
| 421 | false, |
| 422 | ) |
| 423 | .await?; |
| 424 | self.db |
| 425 | .prepare("UPDATE access_tokens SET agent_scope = ? WHERE id = ?") |
| 426 | .bind(&[ |
| 427 | serde_json::to_string(&a.scope)?.into(), |
| 428 | created.info.id.as_str().into(), |
| 429 | ])? |
| 430 | .run() |
| 431 | .await?; |
| 432 | Ok(created) |
| 433 | } |
| 434 | |
| 435 | /// What an agent's token may do, or `None` for any other token. |
| 436 | pub async fn agent_scope(&self, a: TokenArgs) -> Result<Option<AgentScope>> { |
| 437 | let scope: Option<Option<String>> = self |
| 438 | .db |
| 439 | .prepare(format!( |
| 440 | "SELECT agent_scope FROM access_tokens |
| 441 | WHERE token_hash = ? AND (expires_at IS NULL OR expires_at > {SQL_NOW})" |
| 442 | )) |
| 443 | .bind(&[crypto::sha256_hex(&a.token).into()])? |
| 444 | .first::<Option<String>>(Some("agent_scope")) |
| 445 | .await?; |
| 446 | Ok(scope |
| 447 | .flatten() |
| 448 | .and_then(|scope| serde_json::from_str(&scope).ok())) |
| 449 | } |
| 450 | |
| 451 | pub async fn list_access_tokens(&self, a: UserArgs) -> Result<Vec<AccessToken>> { |
| 452 | let mut tokens = self.tokens_where("access_tokens.user_id = ?", &a.user.id).await?; |
| 453 | // Its selected repositories, by name. |
| 454 | self.name_repositories(&mut tokens, &Some(a.user)).await?; |
| 455 | Ok(tokens) |
| 456 | } |
| 457 | |
| 458 | /// The tokens a person or workspace made on purpose: those that do not |
| 459 | /// expire, and those made with an expiry from settings, rather than |
| 460 | /// those issued to an application or a hosted agent. |
| 461 | pub(crate) async fn tokens_where(&self, owner: &str, id: &str) -> Result<Vec<AccessToken>> { |
| 462 | let rows = self |
| 463 | .db |
| 464 | .prepare(format!( |
| 465 | "SELECT {TOKEN_COLUMNS} FROM access_tokens |
| 466 | LEFT JOIN users ON users.id = access_tokens.created_by |
| 467 | WHERE {owner} AND (access_tokens.expires_at IS NULL OR access_tokens.listed = 1) |
| 468 | AND access_tokens.agent_scope IS NULL |
| 469 | ORDER BY access_tokens.id" |
| 470 | )) |
| 471 | .bind(&[id.into()])? |
| 472 | .all() |
| 473 | .await? |
| 474 | .results::<TokenRow>()?; |
| 475 | Ok(rows.into_iter().map(Self::info).collect()) |
| 476 | } |
| 477 | |
| 478 | pub async fn list_workspace_tokens( |
| 479 | &self, |
| 480 | a: WorkspaceTokensArgs, |
| 481 | ) -> Result<Outcome<Vec<AccessToken>>> { |
| 482 | let slug = a.slug.to_lowercase(); |
| 483 | if !a.viewer.as_ref().is_some_and(|viewer| viewer.is_member(&slug)) { |
| 484 | return Ok(Outcome::fail( |
| 485 | FailureCode::Forbidden, |
| 486 | "Only members can see a workspace's access tokens.", |
| 487 | )); |
| 488 | } |
| 489 | let Some(workspace) = self.get_workspace(SlugArgs { slug }).await? else { |
| 490 | return Ok(Outcome::fail(FailureCode::NotFound, "Workspace not found.")); |
| 491 | }; |
| 492 | let mut tokens = self.tokens_where("access_tokens.workspace_id = ?", &workspace.id).await?; |
| 493 | self.name_repositories(&mut tokens, &a.viewer).await?; |
| 494 | Ok(Outcome::Ok(tokens)) |
| 495 | } |
| 496 | |
| 497 | /// The workspace's id, if `actor` is a person who owns it. |
| 498 | pub(crate) async fn owned_workspace(&self, actor: &User, slug: &str) -> Result<Outcome<String>> { |
| 499 | let slug = slug.to_lowercase(); |
| 500 | if actor.kind != PrincipalKind::User || actor.role_in(&slug) != Some(Role::Owner) { |
| 501 | return Ok(Outcome::fail( |
| 502 | FailureCode::Forbidden, |
| 503 | "Only an owner can manage a workspace's access tokens.", |
| 504 | )); |
| 505 | } |
| 506 | Ok(match self.get_workspace(SlugArgs { slug }).await? { |
| 507 | Some(workspace) => Outcome::Ok(workspace.id), |
| 508 | None => Outcome::fail(FailureCode::NotFound, "Workspace not found."), |
| 509 | }) |
| 510 | } |
| 511 | |
| 512 | pub async fn remove_workspace_token( |
| 513 | &self, |
| 514 | a: RemoveWorkspaceTokenArgs, |
| 515 | ) -> Result<Outcome<bool>> { |
| 516 | let workspace_id = match self.owned_workspace(&a.actor, &a.slug).await? { |
| 517 | Outcome::Ok(id) => id, |
| 518 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 519 | }; |
| 520 | let name: Option<String> = self |
| 521 | .db |
| 522 | .prepare("DELETE FROM access_tokens WHERE id = ? AND workspace_id = ? RETURNING name") |
| 523 | .bind(&[a.id.into(), workspace_id.into()])? |
| 524 | .first(Some("name")) |
| 525 | .await?; |
| 526 | if let Some(name) = name { |
| 527 | self.audit_workspace( |
| 528 | &a.actor, |
| 529 | "workspace_token.deleted", |
| 530 | &a.slug.to_lowercase(), |
| 531 | g1t_contracts::audit::Surface::Web, |
| 532 | format!("Deleted workspace access token {name}"), |
| 533 | ) |
| 534 | .await; |
| 535 | } |
| 536 | Ok(Outcome::Ok(true)) |
| 537 | } |
| 538 | } |
| 539 | |
| 540 | #[cfg(test)] |
| 541 | mod tests { |
| 542 | use super::*; |
| 543 | |
| 544 | #[test] |
| 545 | fn a_row_without_scopes_is_legacy_full_access() { |
| 546 | assert_eq!(stored_scopes(None), (None, true)); |
| 547 | assert_eq!(stored_scopes(Some("*")), (None, false)); |
| 548 | assert_eq!( |
| 549 | stored_scopes(Some("issues:write repo:read nonsense")), |
| 550 | (Some(vec!["repo:read".to_owned(), "issues:write".to_owned()]), false) |
| 551 | ); |
| 552 | } |
| 553 | |
| 554 | #[test] |
| 555 | fn scopes_are_stored_as_text() { |
| 556 | let grant = Grant::asked(&Some(vec!["issues:read".to_owned(), "bogus".to_owned()])); |
| 557 | assert_eq!(grant.scopes_column(), "issues:read"); |
| 558 | assert_eq!(Grant::asked(&None).scopes_column(), "*"); |
| 559 | assert_eq!(Grant::asked(&Some(vec![])).scopes_column(), ""); |
| 560 | } |
| 561 | |
| 562 | #[test] |
| 563 | fn only_a_persons_own_token_with_it_turned_on_uses_the_website() { |
| 564 | let row = |extra: serde_json::Value| { |
| 565 | let mut value = serde_json::json!({ "id": "tok_1", "user_id": "usr_1", "workspace_id": null, "last_used_at": null, "agent_scope": null, "scopes": "*", "website": 1.0 }); |
| 566 | for (key, field) in extra.as_object().unwrap() { |
| 567 | value[key] = field.clone(); |
| 568 | } |
| 569 | serde_json::from_value::<Presented>(value).unwrap() |
| 570 | }; |
| 571 | assert!(website_allowed(&row(serde_json::json!({})))); |
| 572 | assert!(!website_allowed(&row(serde_json::json!({ "website": 0.0 })))); |
| 573 | assert!(!website_allowed(&row(serde_json::json!({ "website": null })))); |
| 574 | // A workspace's token, a job's token and an agent's never do. |
| 575 | assert!(!website_allowed(&row(serde_json::json!({ "user_id": null, "workspace_id": "wsp_1" })))); |
| 576 | assert!(!website_allowed(&row(serde_json::json!({ "job_id": "job_1" })))); |
| 577 | assert!(!website_allowed(&row(serde_json::json!({ "agent_scope": "{}" })))); |
| 578 | } |
| 579 | } |