apps/sudo/app/routes/workspace-abuse.tsx · flagon-io/g1t

1

import { ArrowLeft } from "lucide-react";

2

import { Form, Link, data, redirect } from "react-router";

3

4

import type { AdminRunner, IngestToken } from "@g1t/contracts";

5

6

import type { Route } from "./+types/workspace-abuse";

7

import { Badge, Button, EmptyState, Field, Input, Notice, PageHeader, Section, When } from "~/components/ui";

8

import { parseSlug, text } from "~/lib/forms";

9

import { admin, identity, runnersAdmin, telemetry, workspaceProjects } from "~/lib/services.server";

10

import { settle } from "~/lib/settle";

11

import { requireStaff } from "~/lib/staff";

12

import { SUSPEND_WORKSPACE_ABOUT, isSuspensionHold, parseReason, suspensionHold } from "~/lib/suspension";

13

14

export const meta: Route.MetaFunction = ({ params }) => [

15

{ title: `Suspend and clean up · ${params.slug} · sudo` },

16

{ name: "robots", content: "noindex, nofollow" },

17

];

18

19

function slugOf(raw: string): string {

20

const parsed = parseSlug(raw);

21

if (!parsed.ok) throw data("That is not a workspace slug.", { status: 404 });

return parsed.value;

}

/** Each project's ingest tokens, the ones people made (g1t's own for deployments are not listed). */

26

async function telemetryTokens(slug: string): Promise<{ project: { id: string; slug: string; name: string }; tokens: IngestToken[] }[]> {

27

const projects = await workspaceProjects(slug);

28

if (!projects.ok) throw new Error(projects.error.message);

29

return Promise.all(

30

projects.value.map(async (project) => ({

31

project: { id: project.id, slug: project.slug, name: project.name },

32

tokens: await telemetry.tokens({ project_id: project.id }).catch(() => [] as IngestToken[]),

})),

);

}

export async function loader({ params, request, context }: Route.LoaderArgs) {

38

requireStaff(context);

39

const slug = slugOf(params.slug);

40

const [detail, runners, tokens] = await Promise.all([

41

settle(identity.workspace(slug)),

42

settle(runnersAdmin.list(slug)),

43

settle(telemetryTokens(slug)),

44

]);

45

if (detail.ok && !detail.value) throw data(`There is no workspace called ${slug}.`, { status: 404 });

46

const done = new URL(request.url).searchParams.get("done");

47

const DONE: Record<string, string> = {

48

suspended: `Suspended ${slug}, and put a hold on its compute.`,

49

lifted: `Lifted the suspension of ${slug}, and the hold it put on.`,

50

runners: "Removed the runners. What they were running failed; their credentials stopped at once.",

51

tokens: "Revoked the tokens. Anything sending with them is refused from now on.",

};

return {

slug,

suspended: detail.ok ? (detail.value?.suspended ?? null) : null,

56

runners: runners.ok ? runners.value : ([] as AdminRunner[]),

57

runnersError: runners.ok ? null : runners.error,

58

tokens: tokens.ok ? tokens.value : [],

59

tokensError: tokens.ok ? null : tokens.error,

60

error: detail.ok ? null : detail.error,

61

done: done ? (DONE[done] ?? null) : null,

};

}

/** Puts the suspension's hold on, or takes it off, keeping every other allowance. */

66

async function setHold(slug: string, hold: string | null, staff: string, note: string): Promise<string | null> {

67

const account = await admin.account(slug);

68

if (!account.ok) return account.error.message;

69

const { allowances, id, kind } = account.value.summary.account;

70

if (kind === "enterprise") return null;

71

const current = allowances?.hold ?? null;

72

// Lifting takes off only a hold a suspension put there.

73

if (hold === null && !isSuspensionHold(current)) return null;

74

const set = await admin.setAllowances(id, { plan: false, ossRepoMicros: null, trialMicros: null, ...allowances, hold }, note, staff);

75

return set.ok ? null : set.error.message;

76

}

77

78

export async function action({ params, request, context }: Route.ActionArgs) {

79

const staff = requireStaff(context);

80

const slug = slugOf(params.slug);

81

const form = await request.formData();

82

const intent = text(form, "intent");

83

const back = (done: string) => redirect(`/workspaces/${encodeURIComponent(slug)}/abuse?done=${done}`);

84

if (intent === "suspend") {

85

const reason = parseReason(text(form, "reason"));

86

if (!reason.ok) return data({ error: reason.error, section: "suspend" }, { status: 422 });

87

const result = await identity.suspendWorkspace(slug, true, reason.value, staff.email);

88

if (!result.ok) return data({ error: result.error.message, section: "suspend" }, { status: 422 });

89

const held = await setHold(slug, suspensionHold(reason.value), staff.email, `Suspended: ${reason.value}`);

90

if (held) return data({ error: `Suspended, but the hold on its compute was not set: ${held}`, section: "suspend" }, { status: 422 });

91

throw back("suspended");

92

}

93

if (intent === "lift") {

94

const result = await identity.suspendWorkspace(slug, false, "", staff.email);

95

if (!result.ok) return data({ error: result.error.message, section: "suspend" }, { status: 422 });

96

const held = await setHold(slug, null, staff.email, "Suspension lifted");

97

if (held) return data({ error: `Lifted, but the hold on its compute was not taken off: ${held}`, section: "suspend" }, { status: 422 });

98

throw back("lifted");

99

}

100

if (intent === "remove-runners") {

101

const id = text(form, "id") || null;

102

const result = await runnersAdmin.remove(slug, id, staff.email);

103

if (!result.ok) return data({ error: result.error.message, section: "runners" }, { status: 422 });

104

throw back("runners");

105

}

106

if (intent === "revoke-tokens") {

107

const project = text(form, "project");

108

const only = text(form, "id");

109

const tokens = await telemetry.tokens({ project_id: project });

110

for (const token of tokens.filter((token) => !only || token.id === only)) {

111

await telemetry.revokeToken({ project_id: project, id: token.id });

112

}

113

console.log(`sudo: ${staff.email} revoked ingest tokens of ${slug}'s project ${project}`);

114

throw back("tokens");

115

}

116

return data({ error: "Unknown action.", section: "top" }, { status: 400 });

117

}

118

119

export default function WorkspaceAbuse({ loaderData, actionData }: Route.ComponentProps) {

120

const { slug, suspended, runners, runnersError, tokens, tokensError, error, done } = loaderData;

121

const errorFor = (section: string) => (actionData && "section" in actionData && actionData.section === section ? actionData.error : null);

return (

<ArrowLeft size={14} /> {slug}

</Link>

{done && <Notice tone="ok">{done}</Notice>}

130

{error && <Notice tone="warn">Identity did not answer: {error}</Notice>}

</div>

{suspended ? (

Suspended <When at={suspended.at} /> by {suspended.by}: {suspended.reason}

138

</Notice>

139

{errorFor("suspend") && <Notice tone="error">{errorFor("suspend")}</Notice>}

Lift the suspension

</Button>

</Form>

) : (

</Field>

{errorFor("suspend") && <Notice tone="error">{errorFor("suspend")}</Notice>}

Suspend {slug}

</Button>

</Form>

)}

</Section>

{runnersError && <Notice tone="warn">Actions did not answer: {runnersError}</Notice>}

159

{errorFor("runners") && <Notice tone="error">{errorFor("runners")}</Notice>}

160

{runners.length === 0 ? (

161

<EmptyState title="No runners">{slug} has no self-hosted runners.</EmptyState>

162

) : (

163

164

{runners.map((runner) => (

165

166

167

<span className="font-mono">{runner.name}</span>

168

{runner.repo && <span className="text-muted"> · {runner.repo}</span>}

169

170

{runner.os} · {runner.version} · last seen {runner.lastSeenAt ? <When at={runner.lastSeenAt} /> : "never"}

171

{runner.createdBy ? ` · added by ${runner.createdBy}` : ""}

</span>

</span>

{runner.busy && <Badge tone="warn">Running a job</Badge>}

Remove

</Button>

</span>

</Form>

))}

Remove all {runners.length} and end registration tokens

</Button>

</Form>

</div>

)}

</Section>

{tokensError && <Notice tone="warn">Projects or telemetry did not answer: {tokensError}</Notice>}

194

{tokens.every((row) => row.tokens.length === 0) ? (

195

<EmptyState title="No ingest tokens">No project in {slug} has one.</EmptyState>

) : (

{tokens

.filter((row) => row.tokens.length > 0)

.map((row) => (

<span className="font-medium">{row.project.name}</span>

Revoke all {row.tokens.length}

</Button>

</Form>

</div>

{row.tokens.map((token) => (

213

214

<span>

215

{token.name} <span className="font-mono text-xs text-faint">{token.hint}</span>

</span>

Revoke

</Button>

</Form>

</li>

))}

</ul>

</div>

))}

</div>

)}

</Section>

</main>

);

}