| 1 | //! The packages service: the registries a workspace publishes to and |
| 2 | //! installs from, beside its code (docs/PACKAGES.md). Container images |
| 3 | //! first, over OCI Distribution 1.1 on `g1t.sh/v2/` (oci.rs). |
| 4 | //! |
| 5 | //! Other services reach it over `POST /rpc/<method>`; see |
| 6 | //! `g1t_contracts::packages` for the methods and their arguments. Any |
| 7 | //! other request is a registry's own protocol. Files are kept through the |
| 8 | //! `BlobStore` port (store/), metadata in D1 (db.rs). |
| 9 | |
| 10 | mod access; |
| 11 | mod archive; |
| 12 | mod cargo; |
| 13 | mod cargo_http; |
| 14 | mod composer; |
| 15 | mod composer_http; |
| 16 | mod db; |
| 17 | mod digest; |
| 18 | mod limits; |
| 19 | mod manifest; |
| 20 | mod maven; |
| 21 | mod maven_http; |
| 22 | mod names; |
| 23 | mod npm; |
| 24 | mod npm_http; |
| 25 | mod nuget; |
| 26 | mod nuget_http; |
| 27 | mod oci; |
| 28 | mod quota; |
| 29 | mod range; |
| 30 | mod rubygems; |
| 31 | mod rubygems_http; |
| 32 | mod sigv4; |
| 33 | mod store; |
| 34 | mod token; |
| 35 | mod upload; |
| 36 | mod xml; |
| 37 | mod yaml; |
| 38 | |
| 39 | use std::cell::RefCell; |
| 40 | use std::collections::HashMap; |
| 41 | |
| 42 | use g1t_contracts::audit::{AuditActor, AuditTarget, NewAuditEntry, RecordAuditArgs, Surface}; |
| 43 | use g1t_contracts::credentials::Decision; |
| 44 | use g1t_contracts::events::{Event, NewEvent, PackageEvent, Publish}; |
| 45 | use g1t_contracts::identity::GitCredentialsArgs; |
| 46 | use g1t_contracts::packages::*; |
| 47 | use g1t_contracts::repos::{GetArgs, Repo, RepoPath}; |
| 48 | use g1t_contracts::{FailureCode, Outcome, User, Viewer, new_id}; |
| 49 | use g1t_kit::{args, now_ms, reply, rpc_method}; |
| 50 | use worker::{Context, Env, Fetcher, MessageBatch, Request, Response, Result, ScheduleContext, ScheduledEvent, event}; |
| 51 | |
| 52 | use access::{Action, LinkedTo, Target}; |
| 53 | use db::{Db, PackageRow}; |
| 54 | use store::{BlobStore, Store}; |
| 55 | |
| 56 | pub(crate) const SOURCE: &str = "packages"; |
| 57 | /// How large a request body may be: Cloudflare's limit on the zone's plan. |
| 58 | const DEFAULT_MAX_REQUEST_BYTES: u64 = 100_000_000; |
| 59 | /// How many packages a listing shows. |
| 60 | const LIST_LIMIT: u32 = 200; |
| 61 | const VERSIONS_SHOWN: u32 = 200; |
| 62 | /// How much one sweep lets go of. |
| 63 | const SWEEP_BATCH: u32 = 200; |
| 64 | |
| 65 | thread_local! { |
| 66 | /// Pulls counted since the last write, by package: written at most |
| 67 | /// every few seconds, so a busy image costs one write, not one a pull. |
| 68 | /// What an isolate holds when it goes away is lost: the count is |
| 69 | /// approximate. |
| 70 | static DOWNLOADS: RefCell<(HashMap<String, u64>, u64)> = RefCell::new((HashMap::new(), 0)); |
| 71 | } |
| 72 | const DOWNLOADS_FLUSH_MS: u64 = 10_000; |
| 73 | |
| 74 | thread_local! { |
| 75 | /// What billing allows each workspace, as asked last, and when. |
| 76 | static ALLOWANCES: RefCell<HashMap<String, (quota::Allowance, u64)>> = RefCell::new(HashMap::new()); |
| 77 | } |
| 78 | /// How long billing's answer is kept. |
| 79 | const ALLOWANCE_TTL_MS: u64 = 5 * 60 * 1000; |
| 80 | |
| 81 | /// Who made a registry request, as its audit entries and versions name them. |
| 82 | pub struct Caller { |
| 83 | pub actor: Option<AuditActor>, |
| 84 | } |
| 85 | |
| 86 | /// What access decisions need about a package, owned. |
| 87 | pub struct TargetOf { |
| 88 | workspace: String, |
| 89 | repo: Option<(String, String, bool)>, |
| 90 | public: bool, |
| 91 | } |
| 92 | |
| 93 | impl TargetOf { |
| 94 | pub fn package(row: &PackageRow) -> TargetOf { |
| 95 | TargetOf { |
| 96 | workspace: row.workspace.clone(), |
| 97 | repo: row |
| 98 | .repo_id |
| 99 | .as_ref() |
| 100 | .map(|id| (id.clone(), row.repo_name.clone().unwrap_or_default(), !row.public())), |
| 101 | public: row.public(), |
| 102 | } |
| 103 | } |
| 104 | |
| 105 | pub fn view(&self) -> Target<'_> { |
| 106 | Target { |
| 107 | workspace: &self.workspace, |
| 108 | repo: self.repo.as_ref().map(|(id, name, private)| LinkedTo { id, name, private: *private }), |
| 109 | public: self.public, |
| 110 | } |
| 111 | } |
| 112 | } |
| 113 | |
| 114 | pub struct Packages { |
| 115 | pub db: Db, |
| 116 | pub store: Store, |
| 117 | identity: Fetcher, |
| 118 | repos: Fetcher, |
| 119 | events: Fetcher, |
| 120 | /// Signs registry tokens (PACKAGES_TOKEN_SECRET). |
| 121 | secret: Vec<u8>, |
| 122 | max_request: u64, |
| 123 | /// The host package addresses start with: `g1t.sh`. |
| 124 | host: String, |
| 125 | /// Whether free workspaces' package storage is limited (STORAGE_LIMITS |
| 126 | /// `on`); off when self-hosted. |
| 127 | storage_limits: bool, |
| 128 | env: Env, |
| 129 | } |
| 130 | |
| 131 | /// What a workspace's deletion or restoring does to its packages. |
| 132 | #[derive(Debug, PartialEq, Eq)] |
| 133 | pub(crate) enum WorkspaceMark { |
| 134 | /// Hide them from `at`, while the workspace may still be restored. |
| 135 | Hide { workspace: String, at: String }, |
| 136 | /// Show them again. |
| 137 | Show { workspace: String }, |
| 138 | } |
| 139 | |
| 140 | /// The mark `event` asks for, if any. A protected workspace (`protected`, |
| 141 | /// slugs or ids, as identity's PROTECTED_WORKSPACES) is never hidden: it |
| 142 | /// cannot be deleted, so an event saying so is a mistake. |
| 143 | pub(crate) fn workspace_mark(event: &Event, protected: &[String], now: &str) -> Option<WorkspaceMark> { |
| 144 | let text = |key: &str| event.data[key].as_str().map(|v| v.trim().to_lowercase()).filter(|v| !v.is_empty()); |
| 145 | let workspace = text("slug")?; |
| 146 | match event.kind.as_str() { |
| 147 | "workspace.deleting" => { |
| 148 | let id = text("workspaceId").unwrap_or_default(); |
| 149 | if protected.iter().any(|name| *name == workspace || (!id.is_empty() && *name == id)) { |
| 150 | return None; |
| 151 | } |
| 152 | Some(WorkspaceMark::Hide { workspace, at: now.to_owned() }) |
| 153 | } |
| 154 | "workspace.restored" => Some(WorkspaceMark::Show { workspace }), |
| 155 | _ => None, |
| 156 | } |
| 157 | } |
| 158 | |
| 159 | fn not_found<T>() -> Outcome<T> { |
| 160 | Outcome::fail(FailureCode::NotFound, "Package not found.") |
| 161 | } |
| 162 | |
| 163 | impl Packages { |
| 164 | pub fn from_env(env: &Env) -> Result<Packages> { |
| 165 | let secret = store::var(env, "PACKAGES_TOKEN_SECRET"); |
| 166 | if secret.len() < 32 { |
| 167 | return Err(worker::Error::RustError("PACKAGES_TOKEN_SECRET is missing or shorter than 32 characters".into())); |
| 168 | } |
| 169 | // 0 is no limit, as self-hosted (nothing in front cuts bodies short). |
| 170 | let max_request = match store::var(env, "MAX_REQUEST_BYTES").parse::<u64>() { |
| 171 | Ok(0) => u64::MAX, |
| 172 | Ok(limit) => limit, |
| 173 | Err(_) => DEFAULT_MAX_REQUEST_BYTES, |
| 174 | }; |
| 175 | let host = store::var(env, "REGISTRY_HOST"); |
| 176 | Ok(Packages { |
| 177 | db: Db { db: env.d1("DB")? }, |
| 178 | store: Store::from_env(env)?, |
| 179 | identity: env.service("IDENTITY")?, |
| 180 | repos: env.service("REPOS")?, |
| 181 | events: env.service("EVENTS")?, |
| 182 | secret: secret.into_bytes(), |
| 183 | max_request, |
| 184 | host: if host.is_empty() { "g1t.sh".to_owned() } else { host }, |
| 185 | storage_limits: store::var(env, "STORAGE_LIMITS") == "on", |
| 186 | env: env.clone(), |
| 187 | }) |
| 188 | } |
| 189 | |
| 190 | async fn viewer_for(&self, username: &str, secret: &str) -> Result<Viewer> { |
| 191 | g1t_kit::call( |
| 192 | &self.identity, |
| 193 | "user_for_git_credentials", |
| 194 | &GitCredentialsArgs { username: username.to_owned(), secret: secret.to_owned() }, |
| 195 | ) |
| 196 | .await |
| 197 | } |
| 198 | |
| 199 | /// A repository of the workspace by name, whoever may see it. |
| 200 | async fn repo_by_name(&self, workspace: &str, name: &str) -> Result<Option<Repo>> { |
| 201 | if !g1t_contracts::is_valid_repo_name(name) { |
| 202 | return Ok(None); |
| 203 | } |
| 204 | let found: Outcome<Repo> = g1t_kit::call( |
| 205 | &self.repos, |
| 206 | "get", |
| 207 | &GetArgs { |
| 208 | path: RepoPath { namespace: workspace.to_owned(), name: name.to_owned() }, |
| 209 | viewer: Some(User::system(workspace)), |
| 210 | }, |
| 211 | ) |
| 212 | .await?; |
| 213 | Ok(found.into_result().ok().filter(|repo| repo.fork_of.is_none())) |
| 214 | } |
| 215 | |
| 216 | /// Who may do what to an image: the package's own settings, or, before |
| 217 | /// its first push, the repository it will be linked to. |
| 218 | async fn target(&self, name: &names::ImageName, found: Option<&PackageRow>) -> Result<TargetOf> { |
| 219 | if let Some(found) = found { |
| 220 | return Ok(TargetOf::package(found)); |
| 221 | } |
| 222 | let repo = self.repo_by_name(&name.workspace, name.repo_name()).await?; |
| 223 | Ok(TargetOf { |
| 224 | workspace: name.workspace.clone(), |
| 225 | repo: repo.map(|repo| (repo.id, repo.name, repo.is_private)), |
| 226 | public: false, |
| 227 | }) |
| 228 | } |
| 229 | |
| 230 | /// What billing allows the workspace, kept for five minutes. `None` |
| 231 | /// when billing cannot be asked: the push is then let through. |
| 232 | async fn allowance(&self, workspace: &str) -> Option<quota::Allowance> { |
| 233 | let now = now_ms(); |
| 234 | let kept = ALLOWANCES.with(|kept| kept.borrow().get(workspace).copied()); |
| 235 | if let Some((allowance, at)) = kept |
| 236 | && now.saturating_sub(at) < ALLOWANCE_TTL_MS |
| 237 | { |
| 238 | return Some(allowance); |
| 239 | } |
| 240 | let billing = self.env.service("BILLING").ok()?; |
| 241 | let asked: Result<quota::Allowance> = g1t_kit::call( |
| 242 | &billing, |
| 243 | "entitlements", |
| 244 | &g1t_contracts::billing::EntitlementsArgs { workspace: workspace.to_owned() }, |
| 245 | ) |
| 246 | .await; |
| 247 | match asked { |
| 248 | Ok(allowance) => { |
| 249 | ALLOWANCES.with(|kept| kept.borrow_mut().insert(workspace.to_owned(), (allowance, now))); |
| 250 | Some(allowance) |
| 251 | } |
| 252 | Err(error) => { |
| 253 | worker::console_error!("packages: billing could not be asked about {workspace}, letting the push through: {error}"); |
| 254 | None |
| 255 | } |
| 256 | } |
| 257 | } |
| 258 | |
| 259 | /// Why a push of these files (digest and size) into the package may |
| 260 | /// not be kept, if it may not: a free workspace past its free storage. |
| 261 | /// Files the workspace already holds add nothing. |
| 262 | pub(crate) async fn storage_refusal(&self, package: &PackageRow, files: &[(String, u64)]) -> Result<Option<String>> { |
| 263 | if !self.storage_limits || files.is_empty() { |
| 264 | return Ok(None); |
| 265 | } |
| 266 | let digests: Vec<String> = files.iter().map(|(digest, _)| digest.clone()).collect(); |
| 267 | let held = self.db.held(&package.workspace, &digests).await?; |
| 268 | let mut seen = std::collections::HashSet::new(); |
| 269 | let adding: u64 = files |
| 270 | .iter() |
| 271 | .filter(|(digest, _)| !held.contains(digest) && seen.insert(digest.clone())) |
| 272 | .map(|(_, size)| size) |
| 273 | .sum(); |
| 274 | if adding == 0 { |
| 275 | return Ok(None); |
| 276 | } |
| 277 | let Some(allowance) = self.allowance(&package.workspace).await else { |
| 278 | return Ok(None); |
| 279 | }; |
| 280 | let (public_bytes, private_bytes) = self.db.storage(&package.workspace).await?; |
| 281 | let public = package.public(); |
| 282 | let used = if public { public_bytes } else { private_bytes }; |
| 283 | Ok(quota::decide(&allowance, public, used, adding) |
| 284 | .err() |
| 285 | .map(|refusal| quota::message(&package.workspace, &refusal))) |
| 286 | } |
| 287 | |
| 288 | fn count_download(&self, package_id: &str, ctx: &Context) { |
| 289 | let due = DOWNLOADS.with(|counts| { |
| 290 | let mut counts = counts.borrow_mut(); |
| 291 | *counts.0.entry(package_id.to_owned()).or_default() += 1; |
| 292 | let now = now_ms(); |
| 293 | if now.saturating_sub(counts.1) < DOWNLOADS_FLUSH_MS { |
| 294 | return None; |
| 295 | } |
| 296 | counts.1 = now; |
| 297 | Some(counts.0.drain().collect::<Vec<_>>()) |
| 298 | }); |
| 299 | if let Some(due) = due { |
| 300 | let env = self.env.clone(); |
| 301 | ctx.wait_until(async move { |
| 302 | let written = match env.d1("DB") { |
| 303 | Ok(db) => Db { db }.add_downloads(&due).await, |
| 304 | Err(error) => Err(error), |
| 305 | }; |
| 306 | if let Err(error) = written { |
| 307 | worker::console_error!("packages: downloads not counted: {error}"); |
| 308 | } |
| 309 | }); |
| 310 | } |
| 311 | } |
| 312 | |
| 313 | async fn announce(&self, kind: &'static str, package: &PackageRow, data: PackageEvent, caller: &Caller) { |
| 314 | let event = NewEvent { |
| 315 | kind, |
| 316 | source: SOURCE, |
| 317 | repo_id: package.repo_id.clone(), |
| 318 | actor: caller.actor.as_ref().map(|actor| actor.actor_id.clone()), |
| 319 | data, |
| 320 | }; |
| 321 | let published: Result<serde_json::Value> = g1t_kit::call(&self.events, "publish", &Publish { events: vec![event] }).await; |
| 322 | if let Err(error) = published { |
| 323 | worker::console_error!("packages: {kind} not published: {error}"); |
| 324 | } |
| 325 | } |
| 326 | |
| 327 | async fn audit(&self, caller: &Caller, action: &str, package: &PackageRow, path: Option<&str>, surface: Option<Surface>) { |
| 328 | let Some(actor) = caller.actor.clone() else { |
| 329 | return; |
| 330 | }; |
| 331 | let target = AuditTarget { |
| 332 | workspace: package.workspace.clone(), |
| 333 | repo: package.repo_name.as_ref().map(|name| format!("{}/{name}", package.workspace)), |
| 334 | path: Some(path.map_or_else(|| format!("{}:{}/{}", package.ecosystem, package.workspace, package.name), str::to_owned)), |
| 335 | ..AuditTarget::default() |
| 336 | }; |
| 337 | let mut entry = NewAuditEntry::new( |
| 338 | actor, |
| 339 | action, |
| 340 | surface.unwrap_or(Surface::Registry), |
| 341 | target, |
| 342 | &Decision::allow("packages"), |
| 343 | new_id("req", now_ms()), |
| 344 | ); |
| 345 | entry.result = Some("ok".to_owned()); |
| 346 | let recorded: Result<u32> = g1t_kit::call(&self.events, "audit_record", &RecordAuditArgs { entries: vec![entry] }).await; |
| 347 | if let Err(error) = recorded { |
| 348 | worker::console_error!("packages: audit entry not recorded: {error}"); |
| 349 | } |
| 350 | } |
| 351 | |
| 352 | fn summary(&self, row: &db::ListedRow) -> PackageSummary { |
| 353 | let p = &row.package; |
| 354 | PackageSummary { |
| 355 | id: p.id.clone(), |
| 356 | workspace: p.workspace.clone(), |
| 357 | ecosystem: Ecosystem::parse(&p.ecosystem).unwrap_or(Ecosystem::Container), |
| 358 | name: p.name.clone(), |
| 359 | address: match p.ecosystem.as_str() { |
| 360 | "npm" => format!("{}/-/npm/@{}/{}", self.host, p.workspace, p.name), |
| 361 | "composer" => format!("{}/-/composer/{}/{}", self.host, p.workspace, p.name), |
| 362 | "cargo" => format!("{}/-/cargo/{}/{}", self.host, p.workspace, p.name), |
| 363 | "maven" => format!("{}/-/maven/{}/{}", self.host, p.workspace, p.name), |
| 364 | "nuget" => format!("{}/-/nuget/{}/{}", self.host, p.workspace, p.name), |
| 365 | "rubygems" => format!("{}/-/rubygems/{}/{}", self.host, p.workspace, p.name), |
| 366 | _ => format!("{}/{}/{}", self.host, p.workspace, p.name), |
| 367 | }, |
| 368 | visibility: Visibility::parse(&p.visibility), |
| 369 | repo: p.repo_id.as_ref().map(|id| LinkedRepo { |
| 370 | id: id.clone(), |
| 371 | namespace: p.workspace.clone(), |
| 372 | name: p.repo_name.clone().unwrap_or_default(), |
| 373 | }), |
| 374 | description: p.description.clone(), |
| 375 | versions: row.version_count, |
| 376 | latest: db::latest_shown(row), |
| 377 | size: row.bytes, |
| 378 | downloads: p.downloads, |
| 379 | created_at: p.created_at.clone(), |
| 380 | updated_at: p.updated_at.clone(), |
| 381 | } |
| 382 | } |
| 383 | |
| 384 | async fn listed(&self, workspace: &str, ecosystem: Ecosystem, name: &str) -> Result<Option<db::ListedRow>> { |
| 385 | let rows = self.db.list(workspace, Some(ecosystem.as_str()), None, None, LIST_LIMIT).await?; |
| 386 | if let Some(row) = rows.into_iter().find(|row| row.package.name == name) { |
| 387 | return Ok(Some(row)); |
| 388 | } |
| 389 | // Past the first page: read it alone. |
| 390 | Ok(self.db.package(workspace, ecosystem.as_str(), name).await?.filter(|package| !package.hidden()).map(|package| db::ListedRow { |
| 391 | package, |
| 392 | version_count: 0, |
| 393 | bytes: 0, |
| 394 | latest_tag: None, |
| 395 | latest_tag_version: None, |
| 396 | latest_version: None, |
| 397 | })) |
| 398 | } |
| 399 | |
| 400 | async fn list_packages(&self, a: ListPackagesArgs) -> Result<Outcome<Vec<PackageSummary>>> { |
| 401 | let workspace = a.workspace.to_lowercase(); |
| 402 | let rows = self |
| 403 | .db |
| 404 | .list(&workspace, a.ecosystem.map(Ecosystem::as_str), a.repo_id.as_deref(), a.query.as_deref(), LIST_LIMIT) |
| 405 | .await?; |
| 406 | let visible = rows |
| 407 | .iter() |
| 408 | .filter(|row| access::decide(a.viewer.as_ref(), &TargetOf::package(&row.package).view(), Action::Pull).allowed) |
| 409 | .map(|row| self.summary(row)) |
| 410 | .collect(); |
| 411 | Ok(Outcome::Ok(visible)) |
| 412 | } |
| 413 | |
| 414 | async fn get_package(&self, a: GetPackageArgs) -> Result<Outcome<PackageDetail>> { |
| 415 | let workspace = a.workspace.to_lowercase(); |
| 416 | let Some(row) = self.listed(&workspace, a.ecosystem, &a.name).await? else { |
| 417 | return Ok(not_found()); |
| 418 | }; |
| 419 | let target = TargetOf::package(&row.package); |
| 420 | let permissions = access::permissions(a.viewer.as_ref(), &target.view()); |
| 421 | if !permissions.pull { |
| 422 | return Ok(not_found()); |
| 423 | } |
| 424 | let tags = self.db.tags(&row.package.id).await?; |
| 425 | // A yanked or unlisted version reads as deprecated: still there |
| 426 | // for lockfiles that name it, no longer picked for new ones. |
| 427 | let withdrawn = match row.package.ecosystem.as_str() { |
| 428 | "nuget" => "Unlisted: still restored by projects that name it, no longer shown in search.", |
| 429 | "rubygems" => "Yanked: Bundler no longer picks this version for new lockfiles.", |
| 430 | _ => "Yanked: Cargo no longer picks this version for new lockfiles.", |
| 431 | }; |
| 432 | let versions = self |
| 433 | .db |
| 434 | .versions(&row.package.id, VERSIONS_SHOWN) |
| 435 | .await? |
| 436 | .into_iter() |
| 437 | .map(|version| { |
| 438 | let meta = version.meta(); |
| 439 | let text = |key: &str| meta[key].as_str().map(str::to_owned); |
| 440 | PackageVersion { |
| 441 | tags: tags.iter().filter(|tag| tag.version_id == version.id).map(|tag| tag.tag.clone()).collect(), |
| 442 | media_type: text("media_type"), |
| 443 | artifact_type: text("artifact_type"), |
| 444 | platforms: meta["platforms"] |
| 445 | .as_array() |
| 446 | .map(|list| list.iter().filter_map(|p| p.as_str().map(str::to_owned)).collect()) |
| 447 | .unwrap_or_default(), |
| 448 | id: version.id, |
| 449 | version: version.version, |
| 450 | digest: version.digest, |
| 451 | size: version.size, |
| 452 | subject: version.subject, |
| 453 | published_by: version.published_by, |
| 454 | published_at: version.published_at, |
| 455 | deprecated: if version.yanked != 0 { |
| 456 | Some(withdrawn.to_owned()) |
| 457 | } else { |
| 458 | version.deprecated |
| 459 | }, |
| 460 | } |
| 461 | }) |
| 462 | .collect(); |
| 463 | // The README its page shows: npm's, from the latest version. |
| 464 | let readme = match self.db.readme_digest(&row.package.id).await?.and_then(|d| digest::Digest::parse(&d)) { |
| 465 | Some(digest) => match self.db.blob(&digest).await? { |
| 466 | Some(blob) => self.store.read(&blob.object_key).await?.map(|b| String::from_utf8_lossy(&b).into_owned()), |
| 467 | None => None, |
| 468 | }, |
| 469 | None => None, |
| 470 | }; |
| 471 | Ok(Outcome::Ok(PackageDetail { |
| 472 | readme, |
| 473 | package: self.summary(&row), |
| 474 | versions, |
| 475 | tags: tags |
| 476 | .into_iter() |
| 477 | .map(|tag| PackageTag { tag: tag.tag, digest: tag.digest, updated_at: tag.updated_at }) |
| 478 | .collect(), |
| 479 | permissions, |
| 480 | })) |
| 481 | } |
| 482 | |
| 483 | /// The package `actor` asks to change, if they may `action` it. |
| 484 | async fn for_change(&self, actor: &User, workspace: &str, ecosystem: Ecosystem, name: &str, action: Action) -> Result<Outcome<PackageRow>> { |
| 485 | let Some(package) = self.db.package(&workspace.to_lowercase(), ecosystem.as_str(), name).await?.filter(|p| !p.hidden()) else { |
| 486 | return Ok(not_found()); |
| 487 | }; |
| 488 | let target = TargetOf::package(&package); |
| 489 | let decision = access::decide(Some(actor), &target.view(), action); |
| 490 | if decision.allowed { |
| 491 | return Ok(Outcome::Ok(package)); |
| 492 | } |
| 493 | if !access::decide(Some(actor), &target.view(), Action::Pull).allowed { |
| 494 | return Ok(not_found()); |
| 495 | } |
| 496 | Ok(Outcome::fail(FailureCode::Forbidden, decision.reason.unwrap_or_else(|| "Not allowed.".to_owned()))) |
| 497 | } |
| 498 | |
| 499 | async fn delete_version(&self, a: DeleteVersionArgs) -> Result<Outcome<()>> { |
| 500 | let package = match self.for_change(&a.actor, &a.workspace, a.ecosystem, &a.name, Action::Delete).await? { |
| 501 | Outcome::Ok(package) => package, |
| 502 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 503 | }; |
| 504 | let Some(version) = self.db.find_version(&package.id, &a.version).await? else { |
| 505 | return Ok(Outcome::fail(FailureCode::NotFound, "Version not found.")); |
| 506 | }; |
| 507 | let caller = Caller { actor: Some(AuditActor::of(&a.actor)) }; |
| 508 | self.remove_version(&package, &version, &caller).await?; |
| 509 | Ok(Outcome::Ok(())) |
| 510 | } |
| 511 | |
| 512 | async fn delete_package(&self, a: DeletePackageArgs) -> Result<Outcome<()>> { |
| 513 | let package = match self.for_change(&a.actor, &a.workspace, a.ecosystem, &a.name, Action::Delete).await? { |
| 514 | Outcome::Ok(package) => package, |
| 515 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 516 | }; |
| 517 | self.db.delete_package(&package.id).await?; |
| 518 | self.db.measure(&package.workspace).await?; |
| 519 | let caller = Caller { actor: Some(AuditActor::of(&a.actor)) }; |
| 520 | self.announce("package.deleted", &package, self.event_of(&package), &caller).await; |
| 521 | self.audit(&caller, "package.delete", &package, None, a.surface).await; |
| 522 | Ok(Outcome::Ok(())) |
| 523 | } |
| 524 | |
| 525 | async fn set_package(&self, a: SetPackageArgs) -> Result<Outcome<PackageSummary>> { |
| 526 | let package = match self.for_change(&a.actor, &a.workspace, a.ecosystem, &a.name, Action::Delete).await? { |
| 527 | Outcome::Ok(package) => package, |
| 528 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 529 | }; |
| 530 | let caller = Caller { actor: Some(AuditActor::of(&a.actor)) }; |
| 531 | let now = now_ms(); |
| 532 | let before = package.visibility.clone(); |
| 533 | if a.unlink { |
| 534 | self.db.set_link(&package.id, None, "private", now).await?; |
| 535 | } else if let Some(link) = a.link.as_deref() { |
| 536 | let Some(repo) = self.repo_by_name(&package.workspace, link).await? else { |
| 537 | return Ok(Outcome::fail(FailureCode::NotFound, format!("There is no repository {}/{link}.", package.workspace))); |
| 538 | }; |
| 539 | // Linking hands the package to the repository's roles: only |
| 540 | // someone who administers that repository may. |
| 541 | let role = g1t_contracts::access::permission(Some(&a.actor), &repo); |
| 542 | if role < Some(g1t_contracts::access::RepoRole::Admin) { |
| 543 | return Ok(Outcome::fail( |
| 544 | FailureCode::Forbidden, |
| 545 | format!("You need the Admin role on {}/{} to link a package to it.", repo.namespace, repo.name), |
| 546 | )); |
| 547 | } |
| 548 | let visibility = if repo.is_private { "private" } else { "public" }; |
| 549 | self.db.set_link(&package.id, Some((&repo.id, &repo.name)), visibility, now).await?; |
| 550 | } |
| 551 | if let Some(visibility) = a.visibility { |
| 552 | let linked = if a.unlink { false } else { a.link.is_some() || package.repo_id.is_some() }; |
| 553 | if linked { |
| 554 | return Ok(Outcome::fail( |
| 555 | FailureCode::Invalid, |
| 556 | "A linked package has its repository's visibility. Change the repository's, or unlink the package.", |
| 557 | )); |
| 558 | } |
| 559 | self.db.set_visibility(&package.id, visibility.as_str(), now).await?; |
| 560 | } |
| 561 | self.audit(&caller, "package.update", &package, None, a.surface).await; |
| 562 | let Some(row) = self.listed(&package.workspace, a.ecosystem, &package.name).await? else { |
| 563 | return Ok(not_found()); |
| 564 | }; |
| 565 | if row.package.visibility != before { |
| 566 | self.db.measure(&package.workspace).await?; |
| 567 | let event = PackageEvent { visibility: Some(row.package.visibility.clone()), ..self.event_of(&row.package) }; |
| 568 | self.announce("package.visibility_changed", &row.package, event, &caller).await; |
| 569 | } |
| 570 | Ok(Outcome::Ok(self.summary(&row))) |
| 571 | } |
| 572 | |
| 573 | /// Lets go of expired uploads, and of blobs no version has used for a day. |
| 574 | async fn sweep(&self) -> Result<(u32, u32)> { |
| 575 | let now = now_ms(); |
| 576 | let mut uploads = 0; |
| 577 | for row in self.db.expired_uploads(now, SWEEP_BATCH).await? { |
| 578 | if let Some(progress) = row.progress() |
| 579 | && let Err(error) = upload::abort(&self.store, &progress).await |
| 580 | { |
| 581 | worker::console_error!("packages: upload {} not aborted: {error}", row.id); |
| 582 | } |
| 583 | self.db.delete_upload(&row.id).await?; |
| 584 | uploads += 1; |
| 585 | } |
| 586 | let mut blobs = 0; |
| 587 | for blob in self.db.unused_blobs(now, SWEEP_BATCH).await? { |
| 588 | self.store.delete(&blob.object_key).await?; |
| 589 | self.db.forget_blob(&blob.digest).await?; |
| 590 | blobs += 1; |
| 591 | } |
| 592 | Ok((uploads, blobs)) |
| 593 | } |
| 594 | |
| 595 | /// Follows what happens elsewhere: workspaces renamed and deleted, |
| 596 | /// repositories that change visibility, are renamed, move or go. |
| 597 | async fn on_event(&self, env: &Env, event: &Event) -> Result<()> { |
| 598 | // Composer packages are read from repositories: again when one is |
| 599 | // pushed to (its default branch may have gained a composer.json), |
| 600 | // restored, renamed or moved; gone when it is deleted. A failure is |
| 601 | // logged, not retried with the batch: the next push reads it again. |
| 602 | let repo_id = event.repo_id.clone().or_else(|| event.data["repoId"].as_str().map(str::to_owned)); |
| 603 | if let Some(repo_id) = repo_id.as_deref() { |
| 604 | let synced = match event.kind.as_str() { |
| 605 | "git.push" => { |
| 606 | let known = self.db.package_for_repo(repo_id, "composer").await?.is_some(); |
| 607 | if known || event.data["defaultBranch"].as_bool() == Some(true) { |
| 608 | Some(self.sync_composer(repo_id).await.map(|_| ())) |
| 609 | } else { |
| 610 | None |
| 611 | } |
| 612 | } |
| 613 | "repo.deleted" => Some(self.composer_repo_gone(repo_id).await), |
| 614 | "repo.restored" | "repo.renamed" | "repo.transferred" => Some(self.sync_composer(repo_id).await.map(|_| ())), |
| 615 | _ => None, |
| 616 | }; |
| 617 | if let Some(Err(error)) = synced { |
| 618 | worker::console_error!("packages: composer {} for {repo_id}: {error}", event.kind); |
| 619 | } |
| 620 | if event.kind == "git.push" || event.kind == "repo.deleted" || event.kind == "repo.restored" { |
| 621 | return Ok(()); |
| 622 | } |
| 623 | } |
| 624 | let db = &self.db.db; |
| 625 | let protected = g1t_contracts::identity::protected_names(Some(&store::var(env, "PROTECTED_WORKSPACES"))); |
| 626 | match workspace_mark(event, &protected, &g1t_contracts::time::rfc3339(now_ms())) { |
| 627 | Some(WorkspaceMark::Hide { workspace, at }) => return self.db.mark_workspace(&workspace, Some(&at)).await, |
| 628 | Some(WorkspaceMark::Show { workspace }) => return self.db.mark_workspace(&workspace, None).await, |
| 629 | None => {} |
| 630 | } |
| 631 | if g1t_kit::rename::on_event(env, db, event, &[ |
| 632 | "UPDATE packages SET workspace = ?1 WHERE workspace = ?2", |
| 633 | "UPDATE uploads SET workspace = ?1 WHERE workspace = ?2", |
| 634 | "UPDATE workspace_blobs SET workspace = ?1 WHERE workspace = ?2", |
| 635 | ]) |
| 636 | .await? |
| 637 | { |
| 638 | return Ok(()); |
| 639 | } |
| 640 | if g1t_kit::deleted::on_event(db, event, &[ |
| 641 | "DELETE FROM tags WHERE package_id IN (SELECT id FROM packages WHERE workspace = ?1)", |
| 642 | "DELETE FROM version_files WHERE version_id IN (SELECT v.id FROM versions v JOIN packages p ON p.id = v.package_id WHERE p.workspace = ?1)", |
| 643 | "DELETE FROM versions WHERE package_id IN (SELECT id FROM packages WHERE workspace = ?1)", |
| 644 | "DELETE FROM package_blobs WHERE package_id IN (SELECT id FROM packages WHERE workspace = ?1)", |
| 645 | "DELETE FROM uploads WHERE workspace = ?1", |
| 646 | "DELETE FROM workspace_blobs WHERE workspace = ?1", |
| 647 | "DELETE FROM packages WHERE workspace = ?1", |
| 648 | ]) |
| 649 | .await? |
| 650 | { |
| 651 | return Ok(()); |
| 652 | } |
| 653 | // A repository renamed keeps its packages linked under its new |
| 654 | // name; one moved to another workspace leaves them behind, unlinked. |
| 655 | if g1t_kit::transfer::on_event(env, db, event, &[ |
| 656 | "UPDATE packages SET repo_name = ?6 WHERE repo_id = ?5 AND workspace = ?3", |
| 657 | "UPDATE packages SET repo_id = NULL, repo_name = NULL WHERE repo_id = ?5 AND workspace <> ?3", |
| 658 | ]) |
| 659 | .await? |
| 660 | { |
| 661 | return Ok(()); |
| 662 | } |
| 663 | if g1t_kit::lifecycle::on_purged(db, event, &["UPDATE packages SET repo_id = NULL, repo_name = NULL, visibility = 'private' WHERE repo_id = ?1"]) |
| 664 | .await? |
| 665 | { |
| 666 | return Ok(()); |
| 667 | } |
| 668 | if event.kind == "repo.visibility_changed" { |
| 669 | #[derive(serde::Deserialize)] |
| 670 | #[serde(rename_all = "camelCase")] |
| 671 | struct Changed { |
| 672 | repo_id: String, |
| 673 | is_private: bool, |
| 674 | } |
| 675 | |
| 676 | let Ok(changed) = serde_json::from_value::<Changed>(event.data.clone()) else { |
| 677 | worker::console_error!("repo.visibility_changed {} could not be read", event.id); |
| 678 | return Ok(()); |
| 679 | }; |
| 680 | self.db.follow_visibility(&changed.repo_id, changed.is_private).await?; |
| 681 | for workspace in self.db.workspaces_linked_to(&changed.repo_id).await? { |
| 682 | self.db.measure(&workspace).await?; |
| 683 | } |
| 684 | } |
| 685 | Ok(()) |
| 686 | } |
| 687 | } |
| 688 | |
| 689 | #[event(fetch)] |
| 690 | async fn fetch(mut request: Request, env: Env, ctx: Context) -> Result<Response> { |
| 691 | let packages = Packages::from_env(&env)?; |
| 692 | let Some(method) = rpc_method(&request) else { |
| 693 | if request.path().starts_with("/-/npm/") || request.path() == "/-/npm" { |
| 694 | return packages.npm(request, &ctx).await; |
| 695 | } |
| 696 | if request.path().starts_with("/-/composer/") { |
| 697 | return packages.composer(request, &ctx).await; |
| 698 | } |
| 699 | if request.path().starts_with("/-/cargo/") { |
| 700 | return packages.cargo(request, &ctx).await; |
| 701 | } |
| 702 | if request.path().starts_with("/-/maven/") { |
| 703 | return packages.maven(request, &ctx).await; |
| 704 | } |
| 705 | if request.path().starts_with("/-/nuget/") { |
| 706 | return packages.nuget(request, &ctx).await; |
| 707 | } |
| 708 | if request.path().starts_with("/-/rubygems/") { |
| 709 | return packages.rubygems(request, &ctx).await; |
| 710 | } |
| 711 | return packages.registry(request, &ctx).await; |
| 712 | }; |
| 713 | let body: serde_json::Value = request.json().await?; |
| 714 | match method.as_str() { |
| 715 | "list_packages" => reply(&packages.list_packages(args(body)?).await?), |
| 716 | "get_package" => reply(&packages.get_package(args(body)?).await?), |
| 717 | "delete_version" => reply(&packages.delete_version(args(body)?).await?), |
| 718 | "delete_package" => reply(&packages.delete_package(args(body)?).await?), |
| 719 | "set_package" => reply(&packages.set_package(args(body)?).await?), |
| 720 | // For billing: what a workspace's packages hold. |
| 721 | "storage_all" => reply(&packages.db.storage_all().await?), |
| 722 | // Read a repository's Composer package again now, as a push would. |
| 723 | "sync_composer" => { |
| 724 | let a: SyncComposerArgs = args(body)?; |
| 725 | reply(&packages.sync_composer(&a.repo_id).await?) |
| 726 | } |
| 727 | "storage" => { |
| 728 | let a: StorageArgs = args(body)?; |
| 729 | let (public_bytes, private_bytes) = packages.db.storage(&a.workspace.to_lowercase()).await?; |
| 730 | reply(&PackageStorage { public_bytes, private_bytes }) |
| 731 | } |
| 732 | _ => Response::error("Unknown method", 404), |
| 733 | } |
| 734 | } |
| 735 | |
| 736 | /// Every hour: expired uploads are let go, and blobs no version has used |
| 737 | /// for a day are deleted from the store. |
| 738 | #[event(scheduled)] |
| 739 | async fn scheduled(_event: ScheduledEvent, env: Env, _ctx: ScheduleContext) { |
| 740 | let packages = match Packages::from_env(&env) { |
| 741 | Ok(packages) => packages, |
| 742 | Err(error) => { |
| 743 | worker::console_error!("packages: the sweep could not start: {error}"); |
| 744 | return; |
| 745 | } |
| 746 | }; |
| 747 | match packages.sweep().await { |
| 748 | Ok((0, 0)) => {} |
| 749 | Ok((uploads, blobs)) => worker::console_log!("packages: let go of {uploads} uploads and {blobs} blobs"), |
| 750 | Err(error) => worker::console_error!("packages: the sweep failed: {error}"), |
| 751 | } |
| 752 | // Repositories that had a composer.json before the registry did. |
| 753 | match packages.composer_backfill().await { |
| 754 | Ok(0) => {} |
| 755 | Ok(found) => worker::console_log!("packages: found {found} Composer packages"), |
| 756 | Err(error) => worker::console_error!("packages: the Composer backfill failed: {error}"), |
| 757 | } |
| 758 | } |
| 759 | |
| 760 | #[event(queue)] |
| 761 | async fn queue(batch: MessageBatch<Event>, env: Env, _ctx: Context) -> Result<()> { |
| 762 | let packages = Packages::from_env(&env)?; |
| 763 | for message in batch.messages()? { |
| 764 | packages.on_event(&env, message.body()).await?; |
| 765 | } |
| 766 | Ok(()) |
| 767 | } |
| 768 | |
| 769 | #[cfg(test)] |
| 770 | mod tests { |
| 771 | use super::*; |
| 772 | use serde_json::json; |
| 773 | |
| 774 | fn event(kind: &str, data: serde_json::Value) -> Event { |
| 775 | Event { |
| 776 | id: "evt_1".into(), |
| 777 | kind: kind.into(), |
| 778 | source: "identity".into(), |
| 779 | time: "2026-10-06T00:00:00.000Z".into(), |
| 780 | repo_id: None, |
| 781 | actor: None, |
| 782 | data, |
| 783 | } |
| 784 | } |
| 785 | |
| 786 | #[test] |
| 787 | fn a_deleted_workspace_is_hidden_and_a_restored_one_shown() { |
| 788 | let protected = g1t_contracts::identity::protected_names(Some("wsp_keep")); |
| 789 | let now = "2026-10-06T12:00:00.000Z"; |
| 790 | let deleting = event("workspace.deleting", json!({ "workspaceId": "wsp_1", "slug": "Acme", "by": "ana", "purgeAfter": "x" })); |
| 791 | assert_eq!( |
| 792 | workspace_mark(&deleting, &protected, now), |
| 793 | Some(WorkspaceMark::Hide { workspace: "acme".into(), at: now.into() }) |
| 794 | ); |
| 795 | let restored = event("workspace.restored", json!({ "workspaceId": "wsp_1", "slug": "acme" })); |
| 796 | assert_eq!(workspace_mark(&restored, &protected, now), Some(WorkspaceMark::Show { workspace: "acme".into() })); |
| 797 | } |
| 798 | |
| 799 | #[test] |
| 800 | fn protected_workspaces_and_other_events_are_left_alone() { |
| 801 | let protected = g1t_contracts::identity::protected_names(Some("wsp_keep")); |
| 802 | let now = "2026-10-06T12:00:00.000Z"; |
| 803 | let flagon = event("workspace.deleting", json!({ "workspaceId": "wsp_f", "slug": "flagon-io" })); |
| 804 | assert_eq!(workspace_mark(&flagon, &protected, now), None, "always protected"); |
| 805 | let by_id = event("workspace.deleting", json!({ "workspaceId": "wsp_keep", "slug": "kept" })); |
| 806 | assert_eq!(workspace_mark(&by_id, &protected, now), None, "protected by id"); |
| 807 | let purged = event("workspace.deleted", json!({ "workspaceId": "wsp_1", "slug": "acme" })); |
| 808 | assert_eq!(workspace_mark(&purged, &protected, now), None, "the purge is handled apart"); |
| 809 | let nameless = event("workspace.deleting", json!({ "workspaceId": "wsp_1", "slug": "" })); |
| 810 | assert_eq!(workspace_mark(&nameless, &protected, now), None); |
| 811 | } |
| 812 | } |