Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

feat: project repository keys across public clients

Browse Source
This commit is contained in:
Hare
2026-09-02 19:03:55 +09:00
parent c97b3b7b77
commit 96349721cb
56 changed files with 791 additions and 380 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/protocol/src/subscription.rs
+5
View File
@@ -568,6 +568,10 @@ pub struct SubscriptionWorker {
pub profile: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub repository_id: Option<String>,
/// Workspace-facing Repository key. Runtime producers leave this unset and
/// Workspace Server projections replace `repository_id` with this field.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub repository_key: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub working_directory_id: Option<SubscriptionWorkdirId>,
}
@@ -811,6 +815,7 @@ mod tests {
display_name: Some(format!("Worker {value}")),
profile: Some("builtin:coder".to_string()),
repository_id: None,
repository_key: None,
working_directory_id: None,
}
}
crates/ticket/src/lib.rs
+3
View File
@@ -489,6 +489,7 @@ pub struct NewTicket {
pub workflow_state: Option<TicketWorkflowState>,
pub queued_by: Option<String>,
pub queued_at: Option<String>,
#[serde(rename = "repository_key")]
pub repository_id: Option<String>,
pub ref_selector: Option<String>,
}
@@ -519,6 +520,7 @@ impl NewTicket {
#[serde(tag = "action", rename_all = "snake_case")]
pub enum TicketTargetEdit {
Set {
#[serde(rename = "repository_key")]
repository_id: String,
ref_selector: Option<String>,
},
@@ -1610,6 +1612,7 @@ pub struct TicketMeta {
pub workflow_state_explicit: bool,
pub queued_by: Option<String>,
pub queued_at: Option<String>,
#[serde(rename = "repository_key")]
pub repository_id: Option<String>,
pub ref_selector: Option<String>,
pub raw: BTreeMap<String, String>,
crates/ticket/src/tool.rs
+7 -7
View File
@@ -402,8 +402,8 @@ struct TicketCreateParams {
queued_at: Option<String>,
/// Optional target Workspace repository id.
#[serde(default)]
repository_id: Option<String>,
/// Optional target Git ref selector. Requires `repository_id`.
repository_key: Option<String>,
/// Optional target Git ref selector. Requires `repository_key`.
#[serde(default)]
ref_selector: Option<String>,
}
@@ -944,7 +944,7 @@ impl Tool for TicketCreateTool {
input.workflow_state = params.state.map(TicketWorkflowStateParam::into_state);
input.queued_by = None;
input.queued_at = params.queued_at;
input.repository_id = params.repository_id;
input.repository_id = params.repository_key;
input.ref_selector = params.ref_selector;
let created = self
@@ -1173,7 +1173,7 @@ impl Tool for TicketMarkReadyTool {
json!({
"ticket": ticket.meta.id,
"state": ticket.meta.workflow_state.as_str(),
"repository_id": ticket.meta.repository_id,
"repository_key": ticket.meta.repository_id,
"ref_selector": ticket.meta.ref_selector,
"ok": true
}),
@@ -1206,7 +1206,7 @@ impl Tool for TicketIntakeReadyTool {
json!({
"ticket": ticket.meta.id,
"state": ticket.meta.workflow_state.as_str(),
"repository_id": ticket.meta.repository_id,
"repository_key": ticket.meta.repository_id,
"ref_selector": ticket.meta.ref_selector,
"ok": true
}),
@@ -1940,11 +1940,11 @@ mod tests {
fn resolve_target(
&self,
_workspace_id: &str,
repository_id: Option<&str>,
repository_key: Option<&str>,
ref_selector: Option<&str>,
) -> crate::Result<crate::ResolvedTicketTarget> {
Ok(crate::ResolvedTicketTarget {
repository_id: repository_id.unwrap_or("main").to_owned(),
repository_id: repository_key.unwrap_or("main").to_owned(),
ref_selector: ref_selector.unwrap_or("develop").to_owned(),
})
}
crates/tui/src/backend_worker_picker.rs
+1 -1
View File
@@ -370,7 +370,7 @@ fn working_directory_text(worker: &BackendWorkerSummary) -> String {
let cleanliness = wd.cleanliness.as_deref().unwrap_or("unknown");
format!(
"wd:{}:{} {} {}",
wd.repository_id, wd.working_directory_id, wd.status, cleanliness
wd.repository_key, wd.working_directory_id, wd.status, cleanliness
)
}
crates/workdir/src/workspace.rs
+1
View File
@@ -8,6 +8,7 @@
use serde::{Deserialize, Serialize};
pub use workspace_api::{
RuntimeWorkingDirectoryCleanupTarget, RuntimeWorkingDirectorySummary,
WorkingDirectoryCleanupTarget, WorkingDirectoryMaterializerKind as MaterializerKind,
WorkingDirectoryOccupancy, WorkingDirectoryStatusKind, WorkingDirectorySummary,
};
crates/worker-runtime/src/catalog.rs
+2 -2
View File
@@ -92,9 +92,9 @@ pub struct WorkingDirectoryRepository {
}
pub use workdir::workspace::{
MaterializerKind, WorkingDirectoryCleanupTarget, WorkingDirectoryCurrentObservation,
MaterializerKind, RuntimeWorkingDirectoryCleanupTarget as WorkingDirectoryCleanupTarget,
RuntimeWorkingDirectorySummary as WorkingDirectorySummary, WorkingDirectoryCurrentObservation,
WorkingDirectoryOccupancy, WorkingDirectoryProvenance, WorkingDirectoryStatusKind,
WorkingDirectorySummary,
};
#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
crates/worker-runtime/src/runtime.rs
+1
View File
@@ -2402,6 +2402,7 @@ impl RuntimeState {
display_name: worker.request.display_name.clone(),
profile,
repository_id,
repository_key: None,
working_directory_id,
})
}
crates/worker/src/feature/builtin/manage_workdir.rs
+13 -12
View File
@@ -423,12 +423,13 @@ impl WorkspaceHttpWorkdirBackend {
.as_deref()
.map(|value| validate_identity(value, CREATE_TOOL, "runtime_id"))
.transpose()?;
let repository_id = validate_identity(&input.repository_id, CREATE_TOOL, "repository_id")?;
let repository_key =
validate_identity(&input.repository_key, CREATE_TOOL, "repository_key")?;
let selector = validate_optional_selector(input.selector)?;
let workspace_id = encode_path_segment(self.workspace_id()?);
let request = WorkdirCreateRequest {
runtime_id: runtime_id.map(str::to_string),
repository_id: repository_id.to_string(),
repository_key: repository_key.to_string(),
selector,
operation_id: Some(operation_id),
};
@@ -682,10 +683,10 @@ fn create_schema() -> serde_json::Value {
json!({
"type": "object",
"additionalProperties": false,
"required": ["repository_id"],
"required": ["repository_key"],
"properties": {
"runtime_id": {"type": ["string", "null"], "minLength": 1},
"repository_id": {"type": "string", "minLength": 1},
"repository_key": {"type": "string", "minLength": 1},
"selector": {"type": ["string", "null"], "minLength": 1}
}
})
@@ -727,7 +728,7 @@ struct WorkdirListInput {}
struct WorkdirCreateInput {
#[serde(default)]
runtime_id: Option<String>,
repository_id: String,
repository_key: String,
#[serde(default)]
selector: Option<String>,
}
@@ -840,14 +841,14 @@ mod tests {
fn workdir_json(id: &str) -> serde_json::Value {
json!({
"working_directory_id": id,
"repository_id": "main",
"repository_key": "main",
"creation_selector": "refs/heads/main",
"creation_ref": "0123456789abcdef",
"materializer_kind": "local_git_worktree",
"cleanup_target": {
"kind": "git_worktree",
"working_directory_id": id,
"repository_id": "main"
"repository_key": "main"
},
"status": "active",
"cleanliness": "clean",
@@ -973,7 +974,7 @@ mod tests {
#[test]
fn schemas_expose_identities_without_paths_or_session_handles() {
let create = create_schema();
assert_eq!(create["required"], json!(["repository_id"]));
assert_eq!(create["required"], json!(["repository_key"]));
assert_eq!(
create["properties"]["runtime_id"]["type"],
json!(["string", "null"])
@@ -1048,7 +1049,7 @@ mod tests {
.create(
WorkdirCreateInput {
runtime_id: Some("runtime/one".to_string()),
repository_id: "main".to_string(),
repository_key: "main".to_string(),
selector: Some("refs/heads/topic".to_string()),
},
"call-create-1".to_string(),
@@ -1089,7 +1090,7 @@ mod tests {
assert_eq!(requests[1].method, WorkspaceRequestMethod::Post);
let body: serde_json::Value =
serde_json::from_str(requests[1].body.as_deref().unwrap()).unwrap();
assert_eq!(body["repository_id"], "main");
assert_eq!(body["repository_key"], "main");
assert_eq!(body["runtime_id"], "runtime/one");
assert_eq!(body["operation_id"], "call-create-1");
assert_eq!(body["selector"], "refs/heads/topic");
@@ -1380,7 +1381,7 @@ mod tests {
.create(
WorkdirCreateInput {
runtime_id: None,
repository_id: "main".to_string(),
repository_key: "main".to_string(),
selector: None,
},
"call-default".to_string(),
@@ -1405,7 +1406,7 @@ mod tests {
.create(
WorkdirCreateInput {
runtime_id: Some(" ".to_string()),
repository_id: "main".to_string(),
repository_key: "main".to_string(),
selector: None,
},
"call-invalid".to_string(),
crates/worker/src/feature/builtin/merge_request.rs
+2 -2
View File
@@ -56,7 +56,7 @@ struct TicketInput {
#[derive(Debug, Deserialize, JsonSchema)]
struct OpenMergeRequestInput {
ticket: String,
repository_id: String,
repository_key: String,
selector_from: String,
selector_to: String,
#[serde(default)]
@@ -178,7 +178,7 @@ impl Tool for MergeRequestTool {
WorkspaceRequestMethod::Post,
format!("/api/w/{ws}/tickets/{}/merge-request", v.ticket),
Some(
json!({"repository_id":v.repository_id,"selector_from":v.selector_from,"selector_to":v.selector_to,"summary":v.summary}),
json!({"repository_key":v.repository_key,"selector_from":v.selector_from,"selector_to":v.selector_to,"summary":v.summary}),
),
)
}
crates/workspace-api/src/lib.rs
+57 -13
View File
@@ -533,7 +533,7 @@ impl std::fmt::Display for WorkingDirectoryStatusKind {
pub struct WorkingDirectoryCleanupTarget {
pub kind: String,
pub working_directory_id: String,
pub repository_id: String,
pub repository_key: String,
}
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -575,6 +575,51 @@ pub struct WorkingDirectoryOccupancy {
pub linked_at: String,
}
/// Runtime-internal Workdir cleanup authority. This transport intentionally
/// retains the Backend-generated Repository id and is never a Workspace public
/// projection.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(deny_unknown_fields)]
pub struct RuntimeWorkingDirectoryCleanupTarget {
pub kind: String,
pub working_directory_id: String,
pub repository_id: String,
}
/// Runtime-internal Workdir inventory transport. Workspace REST and model-facing
/// surfaces must project this through [`WorkingDirectorySummary`] so the UUID is
/// replaced with `repository_key`.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(deny_unknown_fields)]
pub struct RuntimeWorkingDirectorySummary {
pub working_directory_id: String,
pub repository_id: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub creation_selector: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub creation_ref: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub creation_tree: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub current_selector: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub current_ref: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub current_tree: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub observed_at_epoch_seconds: Option<u64>,
pub materializer_kind: WorkingDirectoryMaterializerKind,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub cleanup_target: Option<RuntimeWorkingDirectoryCleanupTarget>,
pub status: WorkingDirectoryStatusKind,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub cleanliness: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub primary_worker_id: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub occupied_by: Option<WorkingDirectoryOccupancy>,
}
/// Public, provider-neutral Workdir inventory projection.
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
@@ -582,7 +627,7 @@ pub struct WorkingDirectoryOccupancy {
#[serde(deny_unknown_fields)]
pub struct WorkingDirectorySummary {
pub working_directory_id: String,
pub repository_id: String,
pub repository_key: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub creation_selector: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
@@ -629,7 +674,7 @@ impl WorkingDirectorySummary {
pub struct WorkingDirectoryCreateRequest {
#[serde(default, skip_serializing_if = "Option::is_none")]
pub runtime_id: Option<String>,
pub repository_id: String,
pub repository_key: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub selector: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
@@ -1228,7 +1273,7 @@ pub enum RepositoryAccessMode {
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
#[serde(deny_unknown_fields)]
pub struct RepositorySshAccessBinding {
pub repository_id: String,
pub repository_key: String,
pub credential_id: String,
pub host_trust_id: String,
pub access: RepositoryAccessMode,
@@ -1438,8 +1483,7 @@ mod tests {
let repositories = serde_json::json!({
"workspace_id": "workspace-test",
"items": [{
"id": "main",
"display_name": "main",
"repository_key": "main",
"kind": "git",
"provider": "git",
"source": {"kind": "local_path", "uri": "/srv/project"},
@@ -1460,7 +1504,7 @@ mod tests {
let stale = serde_json::json!({
"workspace_id": "workspace-test",
"items": [{
"repository_id": "main",
"repository_key": "main",
"display_name": "main",
"kind": "git",
"provider": "git",
@@ -1497,7 +1541,7 @@ mod tests {
assert!(output.contains(
"export type WorkspaceProfileSourceProvenance = \"project_profile_source_tree\""
));
assert!(!output.contains("repository_id: string, display_name"));
assert!(!output.contains("repository_key: string, display_name"));
}
#[test]
@@ -1754,7 +1798,7 @@ mod tests {
#[test]
fn workdir_create_request_preserves_optional_operation_fields() {
let payload = serde_json::json!({"repository_id": "main"});
let payload = serde_json::json!({"repository_key": "main"});
let request = serde_json::from_value::<WorkingDirectoryCreateRequest>(payload)
.expect("optional create fields may be absent");
@@ -1763,13 +1807,13 @@ mod tests {
assert_eq!(request.operation_id, None);
let serialized = serde_json::to_value(request).expect("serialize create request");
assert_eq!(serialized, serde_json::json!({"repository_id": "main"}));
assert_eq!(serialized, serde_json::json!({"repository_key": "main"}));
}
#[test]
fn workdir_create_request_rejects_stale_or_incomplete_json() {
let stale = serde_json::json!({
"repository_id": "main",
"repository_key": "main",
"selector": "develop",
"path": "/tmp/workdir"
});
@@ -1786,7 +1830,7 @@ mod tests {
fn workdir_summary_omits_absent_optional_fields_on_the_wire() {
let value = serde_json::to_value(WorkingDirectorySummary {
working_directory_id: "workdir-1".into(),
repository_id: "main".into(),
repository_key: "main".into(),
creation_selector: None,
creation_ref: None,
creation_tree: None,
@@ -1830,7 +1874,7 @@ mod tests {
"workspace_id": "workspace-test",
"items": [{
"working_directory_id": "workdir-1",
"repository_id": "main",
"repository_key": "main",
"materializer_kind": "runtime_git_cache",
"status": "active",
"occupied_by": {
crates/workspace-server/src/authority.rs
+45 -9
View File
@@ -918,13 +918,33 @@ impl SqliteWorkspaceAuthority {
self.merge_revision_source
.resolve_subject_ref(&request.repository_id, selector)
});
Some(merge_request_summary(request, current_subject_ref))
let repository_key = self
.store
.get_repository(&self.workspace_id, &request.repository_id)?
.map(|repository| repository.repository_key)
.ok_or_else(|| Error::UnknownRepository(request.repository_id.clone()))?;
Some(merge_request_summary(
request,
repository_key,
current_subject_ref,
))
}
Err(MergeRequestError::NotFound) => None,
Err(error) => return Err(Error::Store(error.to_string())),
};
let repository_key = ticket
.meta
.repository_id
.as_deref()
.map(|repository_id| {
self.store
.get_repository(&self.workspace_id, repository_id)?
.map(|repository| repository.repository_key)
.ok_or_else(|| Error::UnknownRepository(repository_id.to_string()))
})
.transpose()?;
let evidence = ticket_evidence_summary(
ticket.meta.repository_id.as_deref(),
repository_key.as_deref(),
&ticket.events,
merge_request.as_ref(),
);
@@ -980,7 +1000,7 @@ impl SqliteWorkspaceAuthority {
item_revision,
queued_by: ticket.meta.queued_by,
queued_at: ticket.meta.queued_at,
repository_id: ticket.meta.repository_id,
repository_key,
ref_selector: ticket.meta.ref_selector,
risk_flags: ticket.meta.risk_flags,
body,
@@ -1742,6 +1762,7 @@ fn ticket_evidence_event(sequence: usize, event: &TicketEvent) -> TicketEvidence
pub(crate) fn merge_request_summary(
request: MergeRequest,
repository_key: String,
current_subject_ref: Option<String>,
) -> TicketMergeRequestSummary {
let latest_review_request = request.thread.iter().rev().find_map(|event| match event {
@@ -1790,7 +1811,7 @@ pub(crate) fn merge_request_summary(
TicketMergeRequestSummary {
merge_request_id: request.merge_request_id.clone(),
repository_id: request.repository_id.clone(),
repository_key,
state,
review_status,
selector_from: request.selector_from.clone(),
@@ -1835,7 +1856,7 @@ fn ticket_evidence_summary(
let linked_merge_request = merge_request.filter(|request| {
request.state == "open"
&& ticket_repository_id
.is_some_and(|repository_id| repository_id == request.repository_id)
.is_some_and(|repository_id| repository_id == request.repository_key)
});
let has_merge_request = linked_merge_request.is_some();
let has_current_subject_ref = linked_merge_request.is_some_and(|request| {
@@ -1886,7 +1907,7 @@ fn ticket_evidence_summary(
Some(request) if request.state != "open" => missing.push("open_merge_request".to_string()),
Some(request)
if ticket_repository_id
.is_none_or(|repository_id| repository_id != request.repository_id) =>
.is_none_or(|repository_id| repository_id != request.repository_key) =>
{
missing.push("merge_request_repository".to_string())
}
@@ -2823,6 +2844,7 @@ mod tests {
fn merge_request_summary_uses_the_provider_resolved_current_subject() {
let approved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
assert_eq!(approved.review_status, "approved");
@@ -2834,6 +2856,7 @@ mod tests {
let moved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-2".to_string()),
);
assert_eq!(moved.review_status, "pending");
@@ -2846,6 +2869,7 @@ mod tests {
fn ticket_readiness_requires_current_unrevoked_approval_without_a_report() {
let approved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&approved));
@@ -2866,6 +2890,7 @@ mod tests {
let revoked = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, true),
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&revoked));
@@ -2874,6 +2899,7 @@ mod tests {
let changes = merge_request_summary(
reviewed_merge_request(ReviewDecision::RequestChanges, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&changes));
@@ -2883,8 +2909,11 @@ mod tests {
#[test]
fn ticket_readiness_fails_closed_for_missing_or_closed_current_merge_request() {
let unresolved =
merge_request_summary(reviewed_merge_request(ReviewDecision::Approve, false), None);
let unresolved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
None,
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&unresolved));
assert!(!evidence.has_current_subject_ref);
assert!(!evidence.has_commit);
@@ -2892,7 +2921,11 @@ mod tests {
let mut closed_request = reviewed_merge_request(ReviewDecision::Approve, false);
closed_request.state = MergeRequestState::Closed;
let closed = merge_request_summary(closed_request, Some("commit-1".to_string()));
let closed = merge_request_summary(
closed_request,
"main".to_string(),
Some("commit-1".to_string()),
);
let evidence = ticket_evidence_summary(Some("main"), &[], Some(&closed));
assert!(!evidence.has_merge_request);
assert!(!evidence.complete_for_integration);
@@ -2903,6 +2936,7 @@ mod tests {
fn ticket_readiness_requires_request_and_approval_after_substantive_rescope() {
let approved = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let fresh = ticket_evidence_summary(
@@ -2946,6 +2980,7 @@ mod tests {
fn ticket_query_filters_map_to_current_merge_request_evidence() {
let approved_summary = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-1".to_string()),
);
let approved = ticket_evidence_summary(Some("main"), &[], Some(&approved_summary));
@@ -2962,6 +2997,7 @@ mod tests {
let pending_summary = merge_request_summary(
reviewed_merge_request(ReviewDecision::Approve, false),
"main".to_string(),
Some("commit-2".to_string()),
);
let pending = ticket_evidence_summary(Some("main"), &[], Some(&pending_summary));
crates/workspace-server/src/hosts.rs
+6 -5
View File
@@ -313,6 +313,7 @@ impl From<RuntimeSummary> for workspace_api::RuntimeSummary {
pub(crate) fn workspace_worker_summary(
summary: WorkerSummary,
resource_key: String,
working_directory: Option<workspace_api::WorkingDirectorySummary>,
) -> workspace_api::WorkerSummary {
workspace_api::WorkerSummary {
runtime_id: summary.worker.runtime_id,
@@ -341,7 +342,7 @@ pub(crate) fn workspace_worker_summary(
can_stop: summary.capabilities.can_stop,
can_spawn_followup: summary.capabilities.can_spawn_followup,
},
working_directory: summary.working_directory,
working_directory,
diagnostics: summary.diagnostics.into_iter().map(Into::into).collect(),
}
}
@@ -402,10 +403,10 @@ pub struct RuntimeWorkingDirectoryResult {
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(deny_unknown_fields)]
pub struct WorkerSpawnWorkingDirectoryRequest {
/// Safe configured Repository id. The host resolves this id to repository
/// authority from server-side config; browser callers cannot provide raw
/// source paths or runtime-internal storage paths.
pub repository_id: String,
/// Safe configured Repository key. The host resolves this key to internal
/// Repository authority; browser callers cannot provide Backend UUIDs, raw
/// source paths, or Runtime-internal storage paths.
pub repository_key: String,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub selector: Option<String>,
}
crates/workspace-server/src/records.rs
+2 -2
View File
@@ -78,7 +78,7 @@ pub struct TicketDetail {
pub item_revision: String,
pub queued_by: Option<String>,
pub queued_at: Option<String>,
pub repository_id: Option<String>,
pub repository_key: Option<String>,
pub ref_selector: Option<String>,
pub risk_flags: Vec<String>,
pub body: String,
@@ -301,7 +301,7 @@ pub struct TicketActionEligibility {
#[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
pub struct TicketMergeRequestSummary {
pub merge_request_id: String,
pub repository_id: String,
pub repository_key: String,
pub state: String,
pub review_status: String,
pub selector_from: Option<String>,
crates/workspace-server/src/repositories.rs
+8 -1
View File
@@ -97,7 +97,14 @@ impl RepositoryRegistryReader {
}
}
pub fn summary(
pub fn summary(&self, id: &str) -> Result<RepositorySummary, RepositoryLookupError> {
let repository = self
.find(id)
.ok_or_else(|| RepositoryLookupError::UnknownRepository { id: id.to_string() })?;
Ok(self.summary_for_config(repository))
}
pub fn summary_by_key(
&self,
repository_key: &str,
) -> Result<RepositorySummary, RepositoryLookupError> {
crates/workspace-server/src/repository_access.rs
+16 -15
View File
@@ -146,16 +146,17 @@ fn project_repository_access_evaluation(
Error::InvalidInput(format!("invalid Repository access config: {error}"))
})?;
let mut bindings = Vec::with_capacity(config.repository_access.len());
for (repository_id, access) in config.repository_access {
validate_identifier("repository_id", &repository_id)?;
for (repository_key, access) in config.repository_access {
workspace_api::validate_repository_key(&repository_key)
.map_err(|error| Error::InvalidInput(format!("invalid Repository key: {error}")))?;
validate_identifier("credential_id", &access.ssh.credential)?;
validate_identifier("host_trust_id", &access.ssh.host_trust)?;
let repository = store
.get_repository(workspace_id, &repository_id)?
.ok_or_else(|| Error::InvalidInput(format!("unknown Repository `{repository_id}`")))?;
.get_repository_by_key(workspace_id, &repository_key)?
.ok_or_else(|| Error::InvalidInput(format!("unknown Repository `{repository_key}`")))?;
if repository.source.kind != workspace_api::RepositorySourceKind::Ssh {
return Err(Error::InvalidInput(format!(
"Repository `{repository_id}` is not an ssh:// Repository"
"Repository `{repository_key}` is not an ssh:// Repository"
)));
}
let credential = secrets
@@ -182,34 +183,34 @@ fn project_repository_access_evaluation(
})?;
let uri = url::Url::parse(&repository.source.uri).map_err(|_| {
Error::InvalidInput(format!(
"Repository `{repository_id}` has an invalid SSH URI"
"Repository `{repository_key}` has an invalid SSH URI"
))
})?;
if uri.scheme() != "ssh" || uri.username().is_empty() || uri.password().is_some() {
return Err(Error::InvalidInput(format!(
"Repository `{repository_id}` must use ssh://user@host[:port]/path without credentials"
"Repository `{repository_key}` must use ssh://user@host[:port]/path without credentials"
)));
}
let hostname = uri.host_str().ok_or_else(|| {
Error::InvalidInput(format!(
"Repository `{repository_id}` SSH URI has no hostname"
"Repository `{repository_key}` SSH URI has no hostname"
))
})?;
let port = uri.port().unwrap_or(22);
if hostname != host_trust.hostname || port != host_trust.port {
return Err(Error::InvalidInput(format!(
"Repository `{repository_id}` SSH host does not match host trust `{}`",
"Repository `{repository_key}` SSH host does not match host trust `{}`",
access.ssh.host_trust
)));
}
bindings.push(RepositorySshAccessBinding {
repository_id,
repository_key,
credential_id: access.ssh.credential,
host_trust_id: access.ssh.host_trust,
access: access.ssh.access,
});
}
bindings.sort_by(|left, right| left.repository_id.cmp(&right.repository_id));
bindings.sort_by(|left, right| left.repository_key.cmp(&right.repository_key));
Ok(RepositoryAccessProjection {
workspace_id: workspace_id.to_string(),
config_revision,
@@ -1441,7 +1442,7 @@ fn credential_references(
.bindings
.iter()
.filter(|binding| binding.credential_id == credential_id)
.map(|binding| binding.repository_id.clone())
.map(|binding| binding.repository_key.clone())
.collect()
}
@@ -1453,7 +1454,7 @@ fn host_trust_references(
.bindings
.iter()
.filter(|binding| binding.host_trust_id == host_trust_id)
.map(|binding| binding.repository_id.clone())
.map(|binding| binding.repository_key.clone())
.collect()
}
@@ -1912,7 +1913,7 @@ mod tests {
let projection =
project_repository_access_state(&*store, &service, "workspace-a", &state).unwrap();
assert_eq!(projection.bindings.len(), 1);
assert_eq!(projection.bindings[0].repository_id, "remote");
assert_eq!(projection.bindings[0].repository_key, "remote");
assert_eq!(
projection.bindings[0].access,
RepositoryAccessMode::ReadOnly
@@ -1999,7 +2000,7 @@ mod tests {
config_revision: 3,
projection_digest: "sha256:test".to_string(),
bindings: vec![RepositorySshAccessBinding {
repository_id: "main".to_string(),
repository_key: "main".to_string(),
credential_id: "deploy".to_string(),
host_trust_id: "host".to_string(),
access: RepositoryAccessMode::ReadOnly,
crates/workspace-server/src/server.rs
+357 -146
View File
File diff suppressed because it is too large Load Diff
crates/workspace-server/src/store.rs
+38
View File
@@ -1298,6 +1298,16 @@ impl SqliteWorkspaceStore {
repairs.push("create missing worker_diagnostics_archives table".to_string());
}
if current_schema_version < 50 && table_exists(&source, "repositories")? {
let repository_count: i64 =
source.query_row("SELECT COUNT(*) FROM repositories", [], |row| row.get(0))?;
if repository_count > 0 {
repairs.push(format!(
"replace {repository_count} legacy public Repository id(s) with UUIDv7 internal ids, retain each prior id as repository_key, and retire free-form Repository names"
));
}
}
let mut candidate = Connection::open_in_memory()?;
{
let backup = Backup::new(&source, &mut candidate)?;
@@ -12568,6 +12578,18 @@ INSERT INTO worker_registry (
'1', '1', 'local_path', '/repo-a', 1, 'sha256:a', 'unverified'),
('workspace-b', 'main', 'Legacy B', 'git', 'git', '/repo-b', 'develop',
'1', '1', 'local_path', '/repo-b', 1, 'sha256:b', 'unverified');
INSERT INTO typed_tickets (
workspace_id, ticket_id, slug, title, status, kind, priority, body,
workflow_state, workflow_state_explicit, repository_id
) VALUES
('workspace-a', 'ticket-a', 'ticket-a', 'Ticket A', 'open', 'task', 'normal', '', 'planning', 1, 'main'),
('workspace-b', 'ticket-b', 'ticket-b', 'Ticket B', 'open', 'task', 'normal', '', 'planning', 1, 'main');
INSERT INTO merge_requests (
workspace_id, merge_request_id, repository_id, state,
selector_from, selector_to, created_at, updated_at
) VALUES
('workspace-a', 'mr-a', 'main', 'open', 'work/a', 'develop', '1', '1'),
('workspace-b', 'mr-b', 'main', 'open', 'work/b', 'develop', '1', '1');
INSERT INTO artifacts (
workspace_id, artifact_id, kind, uri, created_at,
created_by_kind, created_by_key, created_by_display, repository_id
@@ -12628,8 +12650,24 @@ INSERT INTO worker_registry (
|row| row.get(0),
)
.unwrap();
let ticket_repository_id: String = conn
.query_row(
"SELECT repository_id FROM typed_tickets WHERE workspace_id = ?1",
params![workspace_id],
|row| row.get(0),
)
.unwrap();
let merge_request_repository_id: String = conn
.query_row(
"SELECT repository_id FROM merge_requests WHERE workspace_id = ?1",
params![workspace_id],
|row| row.get(0),
)
.unwrap();
assert_eq!(&artifact_repository_id, repository_id);
assert_eq!(&workdir_repository_id, repository_id);
assert_eq!(&ticket_repository_id, repository_id);
assert_eq!(&merge_request_repository_id, repository_id);
}
assert!(
table_columns(&conn, "repositories")
crates/workspace-server/src/workspace_subscription.rs
+20
View File
@@ -408,6 +408,9 @@ async fn run_workspace_workers(
continue;
};
worker.resource_key = Some(resource_key);
if !project_repository_key(&api, &mut worker) {
continue;
}
let worker_ref = RuntimeWorkerRef::new(&runtime_id, worker.worker_id.as_str());
let revision = next_revision(&mut revisions, &worker_ref);
worker.subject_revision = revision;
@@ -507,11 +510,28 @@ fn install_snapshot(
continue;
};
worker.resource_key = Some(resource_key);
if !project_repository_key(api, &mut worker) {
continue;
}
projected.insert(worker.worker_id.to_string(), worker);
}
workers.insert(runtime_id.to_string(), projected);
}
fn project_repository_key(api: &WorkspaceApi, worker: &mut SubscriptionWorker) -> bool {
let Some(repository_id) = worker.repository_id.take() else {
return true;
};
let Ok(Some(repository)) = api
.store
.get_repository(&api.config.workspace_id, &repository_id)
else {
return false;
};
worker.repository_key = Some(repository.repository_key);
true
}
async fn send_event(
outbound: &mpsc::Sender<WsMessage>,
subscription_id: &SubscriptionId,